More than 41,000 Android TV set-top boxes in South Africa were secretly being used by cybercriminals, with malicious software installed on the devices before their owners even switched them on for the first time.
Cybersecurity company TrendAI identified 41,651 affected devices in South Africa between June and October 2026. They formed part of a much larger network of more than 1.3 million compromised devices across over 200 countries, which Google and several cybersecurity companies have now disrupted.
The network, known as X.CPE, allowed criminals to use people’s internet connections to commit advertising fraud, route internet traffic through their home networks and install additional malicious software. All of this could happen while the TV boxes continued working normally.
Google says the malware was deliberately built into devices by Chinese manufacturer Videostrong Technology, a company that made Android-based hardware for different brands. The manufacturer then allegedly sold access to the compromised devices to other criminal operators.
What’s especially concerning is that some of these devices had passed Google’s own Android certification process, which is supposed to check that hardware meets its security requirements.
The malware was already there when customers bought the devices
Most malware infections involve someone downloading a malicious application, clicking a suspicious link or unknowingly giving an attacker access to their device.
X.CPE worked differently because the malicious software was already embedded in the device’s firmware, the software responsible for controlling the hardware, before it reached the customer.
Google’s investigation into X.CPE found that Videostrong had developed a way to evade its security checks and activate the malware after the device was switched on.
Once connected to the internet, an affected TV box could communicate with servers operated by the attackers, receive instructions and download additional software without its owner’s permission.
The malware also had unusually extensive access to the device. Researchers found that it could disable Google Play Protect, install applications silently, capture screenshots, collect account information and execute commands remotely.
Even uninstalling the malicious application wasn’t necessarily enough. The software could reinstall itself from the device’s firmware when it restarted.
Google says it has high confidence that Videostrong deliberately developed and operated the network to generate revenue. The company believes the operation was too extensive and carefully maintained to have been the work of a rogue employee or an accidental security failure.
It has since cut ties with Videostrong and banned the company, including its future subsidiaries and affiliates, from manufacturing certified Android devices or supplying software to other certified manufacturers.
How criminals made money from people’s internet connections
One of the main ways X.CPE generated money was by turning ordinary household internet connections into what are known as residential proxies.
A proxy allows internet traffic to pass through another connection. In this case, someone elsewhere in the world could route their online activity through an infected TV box in South Africa, making that activity appear to originate from the South African household’s IP address.
The homeowner wouldn’t necessarily know that someone else was using their connection. They might simply be watching Netflix or YouTube while the device quietly carried other people’s internet traffic in the background.
Criminals could use these connections to disguise where their activities originated, bypass restrictions or make fraudulent traffic appear to come from ordinary residential internet users.
The devices were also used for advertising fraud, including generating fake video views and other interactions that advertisers could end up paying for. Researchers identified additional malware capable of collecting information and maintaining remote access to compromised devices.
That makes X.CPE different from the familiar attacks where criminals try to trick someone into handing over information. As we’ve seen with phishing attacks targeting businesses, criminals often depend on getting someone to click a link or open a malicious file. In this case, the owner didn’t have to do anything wrong. Buying the device and connecting it to the internet was enough.
Gareth Redelinghuys, TrendAI’s country managing director for Sub-Saharan Africa, says the company’s researchers identified more than 41,000 affected devices locally over five months.
He says the findings show how South African households and small businesses could become involved in criminal activity without ever knowing that their internet connections had been compromised.
The 41,651 figure represents affected devices identified by TrendAI, rather than a confirmed count of individual households. The research also doesn’t establish how many South African owners experienced direct financial losses or identity theft.
Google has shut down the network, but the devices still have malware
Google worked with TrendAI, Plume, Lumen, HUMAN Security, Synthient and Japan’s National Police Agency to dismantle the infrastructure controlling X.CPE.
The operation involved taking legal action against the domains and servers that allowed the attackers to communicate with infected devices and distribute additional malware.
Google also targeted infrastructure used by more than a dozen related malware families. Because these criminal groups distributed their software through other channels, the company estimates that the takedown will cut off access to at least 10 million additional compromised devices worldwide.
That doesn’t mean another 10 million TV boxes were infected with X.CPE. The estimate includes other devices controlled through malware connected to the same criminal network.
There is also an important difference between stopping malware from communicating with its operators and actually removing it from a device.
The takedown has disrupted the servers used to control infected hardware, but it hasn’t necessarily removed the malicious software embedded in the firmware. Google’s investigation found that the backdoor could survive attempts to uninstall it, and security researchers have warned that affected hardware may remain vulnerable.
For anyone in South Africa using an Android-based TV box, particularly a cheaper device sold under an unfamiliar brand, the findings are an important reason to check exactly what hardware they own.
The infection doesn’t mean that every Android TV device is compromised, and there’s no evidence that all devices from a particular retailer or internet provider were affected.
However, anyone who discovers that their model was part of the X.CPE network should consider disconnecting it from their home network and replacing it rather than assuming that a factory reset will remove malware built into the firmware.
Google says it has changed its certification and firmware review processes to make similar attacks harder to carry out.