SecurityNov 4, 2026, 1:57 PM UTC·1 min read

Google disrupts Android botnet of over a million set-top boxes

Google has taken down a botnet of more than one million Android devices. The malware was apparently installed at the factory by the set-top box maker itself.

An Android set-top box connected to a television, with a red warning symbol indicating a malware-infected botnet device. — Image: Security

Google has disrupted a botnet made up of more than one million infected Android devices. According to the findings, the network did not originate with outside attackers: it apparently came from the manufacturer of the devices themselves, which were already contaminated with malware when they left the factory.

The affected products are Android set-top boxes, the small streaming and TV devices that connect to a television and are often sold at low prices. Google accuses the maker of these boxes of being behind the infection. The company has not been named in the material available so far, and further details of the takedown have not been made public here.

Why it matters

The case shows how serious a supply-chain compromise can be. When malware is present from the first boot, owners have no chance to avoid it through careful behavior, and ordinary security measures such as avoiding suspicious apps do not help. Infected devices can be pulled into a botnet without their users noticing anything.

For consumers, the incident is a reminder that cheap, little-known hardware can carry risks that are hard to detect. Devices that sit permanently on a home network are especially sensitive, because a compromised box can serve as a foothold for further abuse.

What comes next

With the botnet disrupted, attention turns to the manufacturer and to the question of how the affected devices can be cleaned or replaced. Owners of Android set-top boxes from unknown brands should watch for official guidance and consider whether their device is still safe to use.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Dialo: learn languages by speaking

Talk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.

ediviewer: read EDI files like documents

Open EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.

giftdetect: the right gift in minutes

Pick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.

Tags:googleandroidbotnetmalwareset-top boxsupply chain