Backdoored firmware turned 1.3 million TV boxes into proxy nodes
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Wednesday, November 4th, 2026.
More than 1.3 million Android TV boxes were enrolled in a botnet through malware built into their firmware. The backdoor sold access to criminal affiliates, which used infected devices for residential proxy services, advertising fraud and the delivery of additional malware. Disruption efforts targeted the control infrastructure and may sever access to at least 10 million other compromised devices. The same malware also appeared on some telehealth, karaoke and digital-signage devices.
For leaders, the risk is that low-cost connected equipment can quietly expose a trusted network connection to outside abuse. For defenders, ordinary software removal may not be enough. The malware had system-level persistence, could reinstall after removal and could receive commands for software installation, shell execution and screen capture.
The manufacturer was banned from producing certified devices with preloaded Google applications. The larger lesson is that hardware and firmware supply chains can continue monetizing customer trust long after a device has been purchased.
Organizations should inventory unmanaged Android devices, isolate them from sensitive networks and replace affected models rather than relying on removal alone.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
