The Android TV Botnet That Turned 1.3 Million Devices Into Proxies

Google and industry partners dismantled a botnet comprising more than 1.3 million Android TV set-top boxes in a coordinated action. The infected devices shipped with malicious firmware pre-installed, meaning many owners had no idea their hardware was compromised from the moment they plugged it in. Experts involved in the operation estimate the takedown severed the botnet's command-and-control access to over 10 million additional compromised systems, including Android-based healthcare monitors, karaoke machines and other IoT devices. The scale suggests a long-running operation with deep access to manufacturing or distribution chains.

The malware on these set-top boxes performed two main functions: it silently rented out the infected device's internet connection as a proxy to unknown third parties, and it automatically generated fraudulent advertising impressions. From the perspective of a website or ad network, traffic from these devices appeared legitimate because it originated from residential IP addresses. Owners noticed nothing unusual because the malware consumed only marginal bandwidth and processing power, hiding itself in the background.

The proxy rental was the botnet's primary revenue stream. Criminals and unscrupulous businesses rent access to residential proxy networks to mask their activity, evade geographic restrictions, scrape websites at scale, and distribute content unlawfully. A network of 1.3 million residential proxies spread across different ISPs and regions is far more valuable to attackers than a smaller datacenter proxy service, because residential proxies are harder for targets to blacklist en masse.

The critical vulnerability was that malware arrived pre-loaded on devices at the factory or during distribution. This is far more effective than trying to breach individual devices after they are in homes, because owners trust devices they have just unboxed. A handful of compromised devices in a warehouse or shipping facility can infect millions of units bound for retail shelves across multiple countries.

Manufacturers of budget set-top boxes often prioritize cost and time-to-market over security audits. Firmware signing, secure boot verification and regular security updates are less common in the IoT and smart TV space than in smartphones or laptops. Once a device ships, many owners never update the firmware, leaving vulnerabilities and malware in place for years. A single compromised firmware image distributed widely can spawn a massive botnet with minimal ongoing effort from the attacker.

Residential proxy networks occupy an uneasy space between legitimate business use and criminal abuse. Website scraping, performance testing, and security research all use proxies; so do criminals evading fraud detection, bypassing account lockouts, and distributing malware. The botnet's proxy rentals likely ended up in the hands of darknet marketplace operators, credential-stuffing services, and ad fraud rings. A criminal renting 100,000 residential proxies for a week pays far less than the harm they cause to legitimate businesses and users.

The distinction between a residential proxy and a hijacked device is invisible to the end user whose home connection is being abused. Their ISP connection may be flagged for suspicious activity, their bandwidth bill inflated, and their device's lifespan shortened by constant malicious use. The device owner bears the cost and the risk while the attacker and proxy reseller pocket the profit.

This operation exposed a widespread manufacturing or supply-chain vulnerability affecting not just TV boxes but also healthcare devices and entertainment systems. Law enforcement and tech firms working together can shut down a botnet's command infrastructure, but the devices themselves remain compromised until owners manually flash clean firmware or replace the hardware. Most affected users will never know their device was part of a botnet.

The takedown also highlights the dependency problem: many IoT devices have no security update path or official recovery mechanism. Owners cannot easily verify that their device is running clean firmware, and manufacturers often lack the infrastructure to push security patches to millions of devices in the field. The incentive to fix such problems is weak because device makers have already sold the hardware and moved on to the next model.

If you own an Android TV set-top box, healthcare device or other smart device, you should take these steps:

1. Check the manufacturer's website for firmware updates and apply any available security patches.
2. Review your device's network settings if accessible, and disable any features you do not recognize or use.
3. Monitor your internet bill and network traffic for unusual spikes that might indicate unauthorized proxy rental.
4. If the device is obscure or from a lesser-known brand, consider whether it is worth keeping on your network or whether replacement with a device from a more security-conscious vendor makes sense.
5. Enable quality-of-service limits on your router to throttle any single device that begins consuming abnormal bandwidth.

For broader protection, keep your router firmware updated, use strong passwords on any administrative accounts, and be skeptical of extremely cheap IoT devices with minimal online reviews or unclear manufacturer information. The cheapest devices are often the least secure.

This botnet demonstrates that IoT security is not a technical problem alone, but a business and incentive problem. Manufacturers save money by shipping devices with minimal security, and the harm falls on users and third parties rather than on the companies that cut corners. Law enforcement can dismantle a botnet's infrastructure, but unless manufacturers are held accountable for pre-installed malware or are incentivized to maintain security over the device's lifetime, the next botnet will likely follow a similar pattern.

The involvement of healthcare IoT devices is particularly concerning because these systems often control or monitor patient care and are rarely replaced or updated as frequently as consumer electronics. A compromised healthcare monitor or drug dispenser affects vulnerable populations directly. Regulatory bodies and healthcare IT standards bodies are increasingly focused on IoT security, but enforcement lags far behind the scale of the problem.

Source: Krebs on Security