CONSUMERS face a hidden cybersecurity threat from Android TV boxes that may already be infected with malicious software before they are purchased, with the XCPE malware capable of surviving factory resets and compromising home networks.
National Cyber Security Agency (NACSA) chief executive Megat Zuhairy Megat Tajuddin said the malware was embedded in the devices' firmware during manufacturing, making it fundamentally different from conventional malware that typically relies on users downloading malicious applications or clicking compromised links.
He said XCPE possessed system-level privileges and persistence mechanisms that allowed it to reinstall itself from protected areas of the device.
"This makes XCPE malware difficult to remove through conventional methods such as uninstalling applications or performing a factory reset," he told Astro Awani yesterday.
Infected devices could also be recruited into botnets and exploited as residential proxies, enabling cybercriminals to conceal traffic associated with their malicious activities.
"These include stealing personal information and access credentials such as usernames and passwords, or executing remote commands through command-and-control infrastructure.
"The devices could also serve as entry points for identifying and exploiting vulnerabilities in other devices connected to users' home networks," he said.
Megat Zuhairy said the threat was particularly difficult for ordinary users to detect because infected devices could continue operating normally while the malware ran in the background.
He said NACSA emphasised the need for security-by-design, ensuring cybersecurity safeguards were incorporated from the earliest stages of device development.
Other preventive measures included regular firmware updates, stronger access controls and network isolation to stop infections from spreading between devices within home networks.
He noted that the growing adoption of Internet of Things (IoT) technology had expanded the potential attack surface, exposing more household devices to cyber threats.
"Technological progress certainly brings convenience, but the increasing use of internet-connected devices (IoT) also expands the attack surface.
"Devices such as smart refrigerators, closed-circuit television (CCTV) cameras and smart televisions could become targets of cyberattacks if they have security vulnerabilities.
"However, the real issue is not dependence on digital technology itself, but how the technology is developed, configured and protected.
"Technology should be used safely, rather than avoided because of cybersecurity threats," he said. - November 9, 2026
