Hidden botnet turns 1.3 million TV boxes into criminal infrastructure
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Monday, November 9th, 2026.
More than 1.3 million Android-based devices across over 200 countries were enrolled in a botnet through software embedded directly in device firmware. Most were TV set-top boxes, but investigators also observed telehealth equipment, karaoke machines and digital signs.
The compromised devices could provide residential proxy access, deliver additional malware and support fraud. That means owners could unknowingly have their bandwidth and internet addresses used for criminal activity. A coordinated disruption severed the botnet’s control domains, and a Google Threat Intelligence Group representative said this effectively rendered the malware benign.
For leaders, the case shows that low-cost connected hardware can introduce supply-chain risk before it ever reaches the organization’s network. For defenders, inventory unmanaged Android devices and examine unusual outbound traffic from entertainment, signage and specialist equipment. Simply removing an application may not be enough because the software could reinstall from the firmware.
Identify uncertified or unmanaged Android devices on the network, then isolate or replace any model that can’t receive a trusted clean firmware image.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
