More than a million ordinary television set-top boxes and smart screens were secretly hijacked to route illicit internet traffic and commit digital fraud, all without their owners knowing. The covert setup turned everyday gadgets plugged into home entertainment systems into an unauthorized botnet—a coordinated network of infected computers controlled remotely by malicious operators.
According to Google, the backdoor was deliberately built into at least 1.3 million devices by one of its manufacturing partners, Shenzhen-based Videostrong Technology Co. The malware was embedded directly into multiple hardware models and brands over several years, using obfuscation methods to install secondary code after owners turned on their devices for the first time. While most of the impacted hardware consisted of Android TV streaming boxes, the software also compromised other internet-connected equipment, including digital signs, karaoke machines, and telehealth monitors.
Google reported that Videostrong monetized the backdoor by selling access to criminal affiliates, who deployed additional software modules onto the infected hardware. These secondary programs ran advertising fraud schemes, stole data, and quietly enrolled the devices into residential proxy networks. By funneling unauthorized network traffic through private living rooms, the attackers could disguise malicious online activities behind the trusted internet connections of ordinary households.
Google said it has dismantled the backdoor and cut all ties with Videostrong, banning the company from building or selling certified Android hardware or supplying related software. Google also acted to take down the command-and-control domains that directed the affiliate modules, a disruption it estimates cut off criminal access to at least 10 million additional compromised devices. Following the incident, the company stated that it has revised its vetting and review process for device manufacturers.