Google Takes Down Botnet Hidden in 1.3 Million Android TV Boxes

Google has dismantled a botnet that was operating in secret on roughly 1.3 million Android TV boxes. The owners of those devices had no idea their televisions and streaming boxes were being used as part of a larger network that could be controlled remotely by the people running the operation.

Google has also cut ties with the company behind the campaign. The available information does not spell out how that company was connected to Google's services, so it is unclear how far its access reached. What is clear is that the takedown removes a large group of compromised devices from the network they were serving.

The case highlights a familiar weak spot. Many Android TV boxes, especially cheap, unbranded models sold through online marketplaces, ship with outdated software or pre-installed code that owners cannot easily inspect. Once a device is compromised, it can be used to route traffic, commit ad fraud, or join attacks on other targets, often without any visible sign to the person who bought it.

If you own one of these boxes, check the list of installed apps for anything you do not recognize, make sure the firmware is up to date, and consider replacing any device that no longer receives security updates. Buying from established manufacturers that commit to ongoing updates remains the safest option.