Backdoored Android Devices Powered a 1.3 Million-Strong Botnet
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Tuesday, November 3rd, 2026.
More than 1.3 million Android devices were turned into a botnet through malware built into products sold by an approved manufacturer. The backdoor appeared mainly in TV set-top boxes, but it was also found in telehealth devices, karaoke machines, and digital signs. Operators used these devices for ad fraud, data theft, and routing malicious traffic through residential connections. Legal and technical action disrupted the control infrastructure and was expected to cut malware modules off from at least 10 million additional compromised devices.
Consumers and businesses may unknowingly host criminal traffic through equipment they consider low risk. The infected products reached more than 170 countries, making this a global hardware and software supply-chain problem. Leaders should extend procurement controls to connected appliances and specialized devices, not just laptops and phones. Defenders need to inventory Android-based equipment, isolate unnecessary devices, and investigate unexpected outbound connections. Block or replace devices that show unexplained remote-management or proxy activity.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
