Malware software manufactured in home IoT devices and used as a springboard for cyber attacks - National Police Agency collaborates with Google to neutralize it

On the 4th, the National Police Agency, in collaboration with Google, announced that it had uncovered a situation in which malicious software had been installed in home Internet of Things (IoT) devices connected to communication lines and was being used as a "springboard" for cyberattacks, and the related servers had been disabled. It is said that a Chinese company that received orders to manufacture the equipment had installed malicious software in advance before shipping it.

Hundreds of billions of yen worth of M&A, considering AI and IoT fields - President of NTT Docomo Business

According to the agency, there are many cases of damage caused by the unauthorized use of devices through downloaded apps, but this is the first time that a case of malicious software being installed without the knowledge of device sellers or purchasers has been discovered.

In connection with a fraudulent internet banking money transfer case being investigated by the Fukuoka Prefectural Police, the device was discovered by tracing the access source. The National Police Agency Cyber ​​Special Investigation Department uncovered the facts and provided the information to Google. According to Google's investigation, more than 1.3 million devices were damaged, and the company removed related servers and suspended business with manufacturers.

According to the agency, the malicious software was found on devices connected to Google's Android TV operating system. A Chinese company that was outsourced the manufacturing process and delivered the products without permission to the outsourcing company. It was sold at mass retailers and online stores around the world.

When a purchaser connects the device to their home line, it is automatically connected to an external control server and a fraudulent app is installed that sends information necessary for ``hijacking'' the device, including the IP address, without permission. Hackers purchased information from companies handling leaked addresses and used it for cyberattacks and fraudulent money transfers.

By using household devices as a springboard, it becomes difficult to identify the source of the attack.

According to the agency, at least 737 cases of fraudulent money transfers via IoT devices were confirmed in 2025 (costing about 1.4 billion yen). IoT devices were used in more than a dozen cases of unauthorized access to companies in 2026. In addition to warning buyers, the agency plans to also call on business partners to be cautious of their business partners.