Did you know? 1.3 million Android TV boxes shipped with malware straight from the factory. Malaysia is among the worst hit

Do you use a cheap Android TV box to watch TV, YouTube or football? This one's for you.

Last week, Google announced it had taken down a botnet controlling more than 1.3 million Android TV boxes worldwide. The shocking part: the malware wasn't downloaded by users. It was installed at the factory.

And according to BGR, most of the infected devices are in Malaysia, Mexico and Brazil.

What happened?

According to Google Threat Intelligence, a piece of malware called XCPE was built straight into the boxes' firmware by a Chinese manufacturer, Videostrong Technology (BleepingComputer).

Google says this "wasn't an isolated rogue insider or a development oversight", but was built deliberately for profit.

Most of the boxes were sold under the MECOOL brand or as unbranded boxes and sticks (Android Headlines). One confirmed infected model is the MECOOL KM9PRO Max.

What does XCPE do?

Whenever your TV box is on, it quietly:

• Clicks fake ads to defraud advertisers (ad fraud)
• Borrows your home internet connection as a "residential proxy", letting criminals use your home IP address for their own activity
• Takes screenshots and scans other devices on the same Wi-Fi network (Android Headlines)
• Switches off Google Play Protect and reinstalls itself every time the box restarts

According to BGR, Videostrong sold access to these boxes to criminal groups.

Did you know? Videostrong was a Google-certified Android partner. It passed Google's security tests because the malicious code only switched on after the box's first boot (BGR).

What has Google done?

• Cut ties with Videostrong and revoked its Android TV licence
• Went to court to shut down the servers controlling the botnet
• Worked with Japan's National Police Agency and security firms including Lumen, HUMAN Security and TrendAI

Google says the action also cut criminals off from at least 10 million more devices infected with other malware, including karaoke machines and digital signage (BleepingComputer).

Why was Malaysia hit so hard?

On Google's map, Malaysia (including Sabah and Sarawak) is among the darkest-shaded countries, meaning the most infections (Productnation). Google didn't publish per-country figures.

Google said the spread "possibly implies market penetration for the brand distributor". In other words, these boxes were simply sold widely here, especially cheaply online.

Is my TV box safe? How to check

1. Check whether the box is Google-certified Open the Play Store → tap your profile icon → Settings → About. Look for Play Protect certification (Productnation).

But remember, Videostrong passed this test too. "Certified" doesn't guarantee it's 100% safe.

2. Know your brand and model If you use a MECOOL box or an unbranded box bought cheaply online, be extra careful.

3. Check your home IP address According to BGR, there are online services that check whether your home IP address is being used as a residential proxy. The list of models linked to this campaign runs to more than 180, but being on the list doesn't confirm a device is infected.

What if my box is infected?

• Deleting an app won't fix it. XCPE lives in the firmware and reinstalls itself (BGR).
• Disconnect the box from the internet or stop using it.
• Change your Wi-Fi password and update your router's firmware.
• Put smart TVs and TV boxes on a guest Wi-Fi network, separate from your phones and computers.
• When buying a new one, choose a brand on the official Android TV partner list.

Google also advises avoiding apps that offer to pay you for "sharing your internet" or "unused bandwidth".

What brand of TV box do you use at home? Have you checked it?