Google dismantles network of 1.3 million infected devices; Brazil is the 2nd most affected country

Summary written by the Panorama newsroom from the sources listed below. Facts are attributed to the original publications.

An operation led by Google, together with other technology companies, took down a network that controlled more than 1.3 million devices without their owners' knowledge, g1 reported. The devices, mostly Android TV boxes, came from the factory with a malicious program called XCPE.

According to cybersecurity firm Trend Micro, Brazil had the second-highest number of compromised devices, behind only Malaysia. Infections were found in 170 countries, and Iraq, Mexico and Taiwan are also among the hardest hit. Besides TV boxes, the program was found in telemedicine equipment, karaoke machines and digital signage panels.

According to Google, manufacturer Videostrong, based in Shenzhen, China, installed the program on purpose and profited by selling criminals access to the devices, which were used to simulate ad views and generate advertising revenue. The company says the manufacturer hid the code to get around the compatibility and security tests required of those offering services such as Android TV, a practice it had followed since late 2024.

Google said it has cut ties with Videostrong, which has been barred from making or selling certified Android devices and from supplying software to other certified manufacturers. The tech giant called the case an unacceptable breach of trust and said it has changed its review process. The operation involved Japan's National Police Agency and companies such as Lumen and HUMAN Security.

Contacted by g1, Brazil's telecommunications regulator, Anatel, which did not take part in the operation, said it fights the sale of non-certified products and that such equipment poses a threat to the country's cyber infrastructure.