Forget what you’re watching—the real show was happening inside your TV box. In a revelation straight out of a cyber-thriller, a massive global botnet has been exposed, one that turned over 1.3 million unsuspecting Android TV boxes into digital slaves for criminals. And the mastermind? The very company that manufactured them. This isn’t a hack; it’s a factory-installed betrayal of trust on an epic scale.

Google, alongside a cadre of white-hat hackers, has finally pulled the plug on the ‘XCPE’ botnet, a sprawling criminal enterprise operated by Chinese manufacturer Videostrong Technology. But the damage is done. For years, popular streaming boxes—sold under brands like MECOOL and promoted by massive tech influencers—came pre-loaded with malware the second you plugged them in. Your cheap gateway to free movies was also a secret gateway for a dark-web marketplace selling your own internet connection.

The scheme was diabolically clever. The infected devices silently enrolled themselves in ‘residential proxy’ services like Honeygain and NetNut, renting out your home IP address to strangers. Who were these strangers? Scammers, hackers, and fraudsters looking to anonymize their crimes, from massive advertising fraud to AI data scraping and even account takeovers. Your Netflix binge was financing a global cybercrime spree. The botnet didn’t stop at TV boxes, either; it slithered into telehealth devices, karaoke machines, and digital signage, creating a hidden army of over 10 million compromised gadgets.

The source of this plague was shockingly brazen. Videostrong didn’t just have weak security; they intentionally baked the backdoor into their firmware, then sold access to the highest criminal bidders. Google, which requires security checks for Android devices, admits the manufacturer found a way to bypass them immediately after first boot. It’s a catastrophic failure of the global tech supply chain, revealing that the quest for cheap streaming has a terrifying hidden cost.

And how did these boxes become so popular? Through the very channels we trust. They were hyped by TikTok influencers and given a glowing (since-retracted) review by the colossal YouTube channel Linus Tech Tips, which propelled them into millions of homes. The takedown is a major victory, severing the botnet’s control, but experts warn the true scale is ‘way higher’ and the problem is endemic. The lesson is clear: if a streaming deal seems too good to be true, your TV box might be watching you back—and selling what it sees.