Your home internet sold to strangers: the hidden network inside TV boxes

A box bought for watching television can become an internet exit point for strangers without its owner knowing. Google's XCPE investigation, published on November 2, 2026, described a network involving more than 1.3 million Android-based devices. This is not a claim about every home connection or every Android TV product: the risk concerns compromised devices carrying the backdoor.

Dji Banner Inside Article - 728x90

What was sold was access to devices

Google Threat Intelligence Group says it assesses with high confidence that Videostrong Technology deliberately developed and operated the backdoor. According to that assessment, access was sold to criminal affiliates, which installed additional software. The modules included advertising fraud and residential proxies that route other people's traffic through a home connection.

With such a proxy, a remote user's connection can reach the internet through your TV box. The destination may therefore see your home's public IP address. This does not mean your internet provider sold your subscription: the research concerns software inside the device.

A disrupted network is not a cleaned device

BleepingComputer's account of the coordinated investigation reports that Google disrupted the controlling infrastructure and cut ties with Videostrong. The manufacturer was also banned from producing certified Android devices or supplying software to other certified vendors. Taking servers offline does not, by itself, establish that a box sitting in someone's home is safe.

Synthient says it found a system-privileged backdoor in a MECOOL KM9PRO Max purchased for analysis. The practical warning is that the problem may go deeper than an ordinary app installed by the user. Removing an application or rebooting is not a guarantee of a clean device.

Photo: Synthient, KM9PRO Max research device. The homepage image is an editorial montage of the actual photographs.

How to read the model list

Synthient's public technical records include model strings such as KM2, KM2PLUS and KM9PRO_MAX. The same document states a crucial limitation: a matching model name alone is not enough to confirm compromise. It would therefore be wrong to label every product from a brand infected. This article does not claim a verified number of affected devices in Türkiye.

If suspicious, disconnect first

Synthient recommends disconnecting suspicious devices and separating smart devices from sensitive systems. A practical starting point is to unplug the TV box's Ethernet cable or disconnect its Wi-Fi, then ask the seller or manufacturer for security information using the exact model and firmware version. Installing an unknown “cleaner” APK could introduce another risk.

Sources: Google Threat Intelligence Group · Synthient research · Technical model list · BleepingComputer. The research was published November 2; this original report was prepared November 8, 2026.