A backdoor that turned 1.3 million internet-connected devices manufactured by a Chinese company into residential proxies and infected them with malware was shut down by Google, the National Police Agency (NPA) and Google has said.

Residential proxies are intermediary services that route internet traffic through household internet connections. They can be misused by cyber criminals to hide their identities as they carry out malicious activities and access or harvest personal data.

In a blog post published on Tuesday, Google announced that it had collaborated with the NPA and other partners last week to dismantle the backdoor and network of infected devices (botnet) established by Shenzhen-based manufacturer Videostrong. The devices impacted are Android TV set-top boxes and other Android-based, internet-connected devices, including karaoke machines and devices used for telehealth and digital signage.

“We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates,” Google said in the post.

Google noted that the backdoor established by Videostrong appears to have been “intentionally developed, deployed, and operated for financial gain,” and suggested that Videostrong sold access to the devices to criminal affiliates and helped load malware modules onto the devices on their behalf.

The blog post explained that Videostrong operators were observed controlling devices to capture live screenshots, inject keystrokes and steal sensitive data, including account and device information — among other activities.

According to the NPA, the case first came to the attention of the Fukuoka Prefectural Police in September 2025 during the course of an investigation into an unauthorized internet bank transfer, which led to the discovery of infected internet-connected devices.

The Kanto Regional Police Bureau’s Cyber Special Investigation Unit found out the manufacturing and sales circumstances of the devices and subsequently reported to Google.

In July, the NPA issued a warning about the danger of internet-connected devices such as smart TVs, digital photo frames, routers and network cameras becoming residential proxies, asking consumers not to download or use software, applications or free VPN services from unknown or unverified providers. It also urged people to be cautious of free streaming services and services that offer compensation in exchange for sharing internet bandwidth.

Residential proxies make cyberattacks harder to detect and trace back to their source. The NPA found that unauthorized internet bank transfers in 2024 were connected to residential proxies in 1,918 cases, causing financial damages of approximately ¥2.89 billion ($18.3 million).

At least several tens of thousands of residential proxy devices are operating within Japan, the National Institute of Information and Communications Technology estimated.