Malicious Software Planted at Manufacturing Stage in Home IoT Devices by Chinese Contractor Without Authorization; Japan's National Police Agency and Google Neutralize Over 1.3 Million Devices

A Chinese contractor tasked with manufacturing the devices was shipping them with the malicious software embedded without the knowledge of the company that placed the order.

This marks the first time that malicious software has been found to be introduced without the involvement of either the seller or the purchaser.

The malicious software was found in connected devices compatible with Google's television operating system "Android TV."

In the wave of unauthorized access incidents targeting companies in 2026, IoT devices were used in more than a dozen cases.

Even after the command-and-control servers were shut down, the malicious software itself is believed to remain within the firmware.