Editorial illustration; the devices and workflow are representative, not a live infection or a real product interface.
A viral news graphic says Malaysia is number one in an Android botnet infection ranking, with 300,390 devices detected. The number is attention-grabbing, but the first question should be: what kind of Android devices are we talking about?
The current story is mainly about Android TV set-top boxes and other Android-based devices, not a finding that 300,390 Malaysian smartphones were infected. That distinction matters because the right response is different. A phone owner should not panic and reset a phone based on a TV-box headline. A person using a cheap Android TV box or projector should not assume that a normal factory reset proves the firmware is clean.
Quick Answer
Google Threat Intelligence reported on 2 November 2026 that it and industry partners had disrupted the XCPE backdoor, which had enrolled more than 1.3 million Android set-top boxes into a botnet. A separate TrendAI measurement, reported by Malaysian Wireless, counted 300,390 observed infected devices associated with Malaysia during its monitoring period. That is a serious signal, but it is not a census of Malaysian homes and it does not identify every affected household, internet provider, seller, or device model.
If you own an Android TV box or Android projector with unclear provenance, pause its internet access, record the exact model and firmware information, check whether the seller offers credible security support, and avoid using it for accounts or sensitive services. If the device cannot be verified or supported, replacement is safer than treating a reset as a guaranteed cure.
What XCPE was
XCPE was a backdoor and botnet ecosystem associated with Android TV devices. Google said the malicious code was built into device firmware across many models and brands over multiple years. That makes the case different from the familiar situation in which a user downloads one obviously suspicious APK.
In the reported chain, a device could start with hidden code, contact command-and-control infrastructure, receive instructions or modules, and be used for criminal activity without the owner knowingly participating. Google described activity including ad fraud, residential proxy use, remote commands, screenshots, and data collection. It also said the operation was attributed with high confidence to Videostrong Technology, an Android OEM and ODM, and that Google had cut ties with the company and banned it from making certified Android devices or supplying software to certified vendors.
The word “botnet” describes the controlled network, not a single application that users can uninstall. A compromised box may continue to display video and appear normal while its internet connection is being used in the background. That is one reason the issue is easy to miss.
What the 300,390 number does—and does not—tell us
The Malaysia figure comes from TrendAI’s observation of the botnet and was reported by Malaysian Wireless. The report says the measurement covered a period from 3 June to 1 October 2026 and that monitoring was intermittent. In plain language, it counts devices observed in the research data; it does not prove that every one of those devices was online at the same moment or that each represented a different Malaysian household.
An IP address is also not the same thing as a person. A home may have multiple devices, an infected device may change networks, and a device may appear under different addresses over time. The number is still important because it suggests a large concentration of observed activity in Malaysia, but precision should not be confused with certainty.
This is also why a screenshot with a bar chart should be treated as a pointer to the underlying report, not as the report itself. Before sharing a graphic, look for the research period, device category, measurement method, and original source. A headline that simply says “Android devices” can make readers think of phones when the underlying investigation is mostly about TV boxes.
Why Malaysia may appear so prominently
The available reports do not establish one complete explanation for Malaysia’s ranking. It would be irresponsible to claim that a particular ISP, shop, or community caused the figure without evidence. The safer interpretation is that Malaysia had a substantial number of observed devices in the botnet’s infrastructure during the measurement period.
Several practical factors can make streaming hardware difficult to manage: devices are often bought through many sellers, support lifetimes are unclear, firmware may not be updated like a mainstream phone, and owners may leave a box connected for long periods. A projector or TV box can also be treated as an appliance even though it is an internet-connected computer with an operating system, storage, accounts, and network permissions.
The supply-chain angle is the most important lesson. A device can pass through a manufacturer, an original design manufacturer, a reseller, and a household before the owner ever sees its settings. Security therefore cannot be reduced to “did the customer click a bad link?”
What owners should do now
1. Identify the device precisely
Write down the manufacturer, model, Android version, firmware version, serial number, seller, and purchase date. Take photographs of the device label and settings pages if you may need to contact the seller. Do not rely on a generic name such as “4K Android box”.
2. Pause unnecessary network access
If the device is not needed immediately, disconnect it from Wi-Fi or Ethernet. This is a containment step, not proof that the device is clean. If it is connected to a network with work computers, cameras, storage, or smart-home equipment, consider moving it to a guest network while you investigate.
3. Check firmware and support
Look for a manufacturer support page that matches the exact model. Be cautious when a device has no identifiable manufacturer, uses a generic firmware label, or asks you to download updates from an unrelated file-sharing site. A credible update path should explain the device, version, release, and installation process.
4. Review apps and security settings
Check installed applications, unusual device administrators, accessibility access, VPNs, proxy settings, and Play Protect status where those controls are available. These checks can reveal suspicious changes, but a clean-looking screen is not a guarantee against a firmware-level backdoor.
5. Protect accounts separately
Do not sign into banking, email, password managers, or work systems on a device whose firmware you cannot trust. If you already used the box for sensitive accounts and you have credible reason to suspect compromise, use a trusted device to change passwords, review active sessions, and contact the relevant service.
6. Ask the seller or manufacturer a specific question
Ask whether the exact model received a security update, whether the firmware is official, and how the company handles a device found to contain pre-installed malware. Keep the response. Vague promises such as “it is Android certified” are not a substitute for an update and support path.
7. Replace or isolate when verification fails
If the device has no trustworthy support, cannot be identified, or behaves unusually, replacement may be the most sensible decision. Do not give the old box to another person as if it were safe. Stop using it, preserve purchase details, and ask a qualified technician or the relevant reporting channel how to dispose of it.
What not to assume
Do not assume every Android phone in Malaysia is part of XCPE. Do not assume the Google Play logo proves that an older device’s firmware has never been compromised. Do not assume factory reset always removes code embedded in firmware. Do not assume a device is harmless because streaming still works. Do not assume changing the Wi-Fi password fixes a device that is itself running unauthorised code.
There is another important distinction: Malaysia has also seen Android banking-trojan campaigns delivered through sideloaded delivery, job, and PDF-reader apps. MyCERT’s LongKong advisory concerns that separate style of threat. It reinforces the general advice to avoid random APKs, but it should not be merged with the XCPE TV-box evidence as if they were one incident.
My Take
The most useful part of this story is not the race to repeat Malaysia’s largest number. It is the reminder that connected hardware has a supply chain and a support lifetime. A cheap box can be a small computer with privileged software, and the owner may have fewer tools to inspect or replace that software than a phone owner does.
The responsible message is precise: the reported figure is serious, the device category matters, the measurement has limits, and owners should make decisions from the exact model and firmware—not from a viral chart alone.
Bottom Line
The XCPE case is a warning about firmware trust, not evidence that every Malaysian Android phone has been hacked. If you own an unclear Android TV box or projector, disconnect it when practical, identify it, check support, avoid sensitive accounts, and replace it if the provenance and security path cannot be established.