Cheap streaming boxes can rent out your Wi-Fi: check what’s plugged into your network

The TV over the bar runs off a little streaming box. Someone bought it online because it was cheap and seemed to get every channel. Nobody has thought about it since — and it may have been working a second job the whole time.

On November 2, Google said it and its partners had dismantled a botnet called XCPE that had enrolled more than 1.3 million Android TV set-top boxes. Google concluded the malware was built into the boxes’ firmware by the manufacturer, Videostrong Technology, which sold access to criminal partners. They used the boxes for ad fraud, to load more malware, and to resell the owners’ internet connections.

What the boxes were doing

A proxy network rents out real internet connections so a stranger’s traffic looks like it’s coming from an ordinary home or business. Krebs on Security reports that this kind of traffic is a major source of account takeovers, ad fraud and mass scraping. On an infected box, that traffic leaves your building under your internet address.

It wasn’t only TV boxes. Google says it also found the malware in telehealth devices, karaoke machines and digital signs. It also took down servers used by the criminal partners, whose malware spreads other ways too, and expects that to cut off access to at least 10 million more infected devices.

The box can also be a way into the rest of your network. In January, Krebs described attackers using infected TV boxes to reach into their owners’ local networks and look for other devices to take over.

Why the takedown doesn’t clean your box

Google took down the servers that ran the botnet and banned Videostrong from making devices with Google’s apps preloaded. That doesn’t remove anything from the boxes already out there. According to Google, if you uninstall the malware it reinstalls itself from the device’s own firmware when it restarts. The Record reports that Google didn’t say whether owners will be notified or whether the malware will be removed. Google told The Record that cutting off the servers leaves the malware “effectively benign.” But the backdoor is still on the box, and Google says these groups quickly move to new tools.

If the malware came in the firmware, deleting it doesn’t get rid of it. The box has to come off your network.

Check what’s plugged in this week

1. 01Walk the building. List every streaming box, stick, smart frame and sign player that connects to your Wi-Fi or a network cable: the bar, the lobby, guest rooms, the break room, showroom displays.
2. 02Look for the warning signs. In a 2025 warning about an earlier TV-box botnet, the FBI listed brands you don’t recognize, boxes sold as “unlocked” or with free content, setup that asked you to turn off Google Play Protect, apps from outside the official stores, and Android devices that aren’t Play Protect certified. One sign alone doesn’t prove anything, and certification isn’t a guarantee: Google says Videostrong got its malware past Google’s own tests.
3. 03Check the model. Security firm Synthient published the device model names it saw in this campaign. A match isn’t proof of infection, but it’s reason enough to replace the box.
4. 04Pull anything suspect. Unplug it and replace it with a box from a major streaming brand. Google’s advice is to buy connected devices only from reputable manufacturers.
5. 05Keep TVs and guests off the network your card machines use. A properly set-up guest network keeps visitors’ devices from reaching the rest of your network. Put streaming boxes you trust there too, and keep card terminals and the office computer on their own. A guest network won’t stop an infected box from renting out your connection, so suspect boxes still come out. Ask whoever set up your network to confirm how it’s split. It’s the same separation we recommend in our PCI compliance guide.

Start with the bar TV

Before the weekend, walk the building and write down every box on your network. Anything you can’t name the brand of, or that shows up on Synthient’s list, comes out. If you want a second set of eyes on how your card equipment is connected, talk to an expert at 770-766-1060.