Google has disclosed that Chinese company SVIC is suspected of preloading malware into its set-top boxes, with more than 1 million related devices worldwide now part of a botnet. On the same day, separate researchers found that commercial spyware may use online ads to launch "zero-click" attacks on users. The two incidents point to security risks in the IoT hardware supply chain and the endpoint software ecosystem respectively.
Set-top boxes shipped with malware, over 1 million devices pulled into botnet
According to Google, set-top boxes made by SVIC were found to be preloaded with malware, pulling more than 1 million devices worldwide into a botnet. A botnet is a cluster of infected devices remotely controlled by attackers, which can be used to launch distributed denial-of-service attacks, send spam or steal data.
It is not yet clear what the malware does or how far its impact extends; Google did not provide further technical details in its disclosure. SVIC is a Chinese set-top box manufacturer whose products are sold in markets worldwide.
The incident has raised concerns about the security of the IoT device supply chain, especially the risk that preinstalled software can become an attack entry point.
Ads become a zero-click entry point for spyware
On the same day, researchers found that commercial spyware may use online ads to attack users, a technique known as a "zero-click" attack. Zero-click attacks trigger without any user interaction; attackers can infect target devices simply by placing malicious ads.
The researchers noted that this method lowers the bar for attacks and could be widely exploited by commercial spyware. Unlike the set-top box botnet, this attack vector sits at the software ecosystem level, underscoring the complexity of endpoint security threats.
| Incident | Attack vector | Scope of impact | Risk layer |
|---|---|---|---|
| SVIC set-top boxes preloaded with malware | Preinstalled hardware software | Over 1 million devices worldwide | IoT supply chain |
| Commercial spyware zero-click attack | Online ad placement | Not yet disclosed | Software ecosystem |
What to watch
SVIC has not yet publicly responded to Google's allegations. The industry is watching whether Google will release further technical details and whether affected device makers will issue security updates.
The researchers' discovery of the zero-click ad attack may also push ad platforms and browser makers to strengthen their defenses. Going forward, watch whether regulators open investigations and whether the botnet continues to expand.