More than 1.3 million Android TV streaming devices were compromised by malicious software that allowed cybercriminals to remotely control them, according to Google.
The malware was installed before consumers purchased the devices, allowing criminals to steal information, generate fraudulent advertising revenue and secretly use household internet connections.
Google says it has dismantled the botnet and banned the manufacturer responsible, but consumers with affected devices may still be at risk because the malicious software can remain installed.
Millions of consumers have purchased inexpensive Android TV streaming boxes to watch movies, television programs and other online entertainment. But Google is warning that some of those devices came with a dangerous feature that buyers never knew existed.
In a report published November 2, Google's Threat Intelligence Group disclosed that more than 1.3 million Android-based set-top boxes had been secretly enrolled in a criminal network known as the XCPE botnet.
A botnet is a collection of internet-connected devices that criminals can control remotely, often without their owners knowing anything is wrong.
Google says the malware was not the result of consumers downloading suspicious applications or clicking malicious links. Instead, investigators concluded that it was deliberately installed by the manufacturer.
The company identified Videostrong Technology Co., an Android device manufacturer, as the organization responsible for developing and operating the malicious network.
Google said it had high confidence that the operation was intentionally designed to generate revenue by giving criminal groups access to consumers' devices.
How criminals used consumers' televisions
According to Google, the malicious software was embedded in the devices' firmware, the software that controls their basic operations.
Once connected to the internet, the devices could communicate with servers operated by the criminals, allowing them to receive instructions and install additional malicious programs.
Investigators identified several ways the devices were exploited.
One involved advertising fraud. Criminals allegedly used the infected devices to generate fake advertising views and clicks, collecting revenue for activity that never involved a real consumer.
The scheme involved turning the devices into what are known as residential proxies. That allowed criminals to route internet traffic through consumers' home connections, making the traffic appear to originate from an ordinary household rather than a criminal operation.
This could potentially expose consumers to unwanted network activity and make it harder for investigators to identify the actual source of malicious traffic.
Google also found that the malware could capture screenshots, execute commands, install applications without permission and collect sensitive information, including account details and device data.
In some cases, the software could even disable Google Play Protect, the security feature designed to identify potentially harmful Android applications.
Google says the manufacturer deliberately concealed the malware
One of the most troubling findings was that the malicious software was designed to evade Google's security checks.
According to the company, Videostrong used techniques that allowed the malicious code to activate after a device was first turned on, avoiding detection during certification testing.
The malware was also designed to survive attempts to remove it. If a consumer deleted the malicious application, the software could reinstall itself when the device restarted.
Google said the evidence indicated the operation was not simply a mistake or the work of a single employee acting independently.
The company has terminated its relationship with Videostrong and prohibited the manufacturer and its affiliates from producing certified Android devices or supplying software to other certified manufacturers.
Google also worked with law enforcement and cybersecurity companies to dismantle the servers controlling the botnet.
The company estimates that disrupting related criminal infrastructure could cut off access to at least 10 million additional compromised devices beyond the 1.3 million directly associated with XCPE.
As of today, Videostrong has not responded publicly to the Google report.
What consumers should do
Although Google says the criminal network has been disrupted, that does not necessarily mean the malicious software has disappeared from affected devices.
Consumers who purchased inexpensive Android streaming boxes, particularly devices from unfamiliar manufacturers, should take precautions.
Security experts recommend several steps:
Check the manufacturer and model. Look for information about whether the device is Google Play Protect certified. Certification provides an additional layer of security, although it is not an absolute guarantee.
Install available security updates. Check whether the manufacturer continues to provide legitimate firmware updates.
Be cautious about unfamiliar applications. Unexpected apps, unusual network activity or unexplained changes in device behavior may warrant further investigation, although infected devices may show no obvious symptoms.
Disconnect a suspected infected device. Because this particular malware can survive ordinary removal attempts, a factory reset may not eliminate it. Replacing a confirmed compromised device may be the safest option.
Protect your accounts. If you used a compromised device to access Google or streaming accounts, change the passwords using a trusted phone or computer.
The warning does not mean that all Android TVs or Google TV devices are infected. Google's investigation primarily involved set-top boxes, although researchers also identified malware on some other Android-based products, including karaoke machines, telehealth equipment and digital signage.
A growing threat from connected devices
The discovery highlights a cybersecurity problem that extends beyond televisions.
As consumers connect more devices to their home networks, including streaming boxes, cameras, appliances and other smart products, each device can become a potential target for criminals.
The XCPE case is particularly concerning because the malware was reportedly installed during manufacturing, meaning consumers had little opportunity to avoid infection through ordinary precautions.
Google says it has strengthened its certification and firmware review procedures to reduce the chances of similar incidents.
For consumers, the lesson is that the lowest-priced streaming device may not always be the safest bargain. Purchasing equipment from reputable manufacturers that provide security updates and maintain recognized certifications can reduce the risk of bringing a compromised device into the home.