Google says Android partner Videostrong shipped 1.3 million TV boxes with built-in botnet backdoor

Google says one of its Android device partners, Shenzhen-based Videostrong Technology, deliberately built a backdoor into roughly 1.3 million devices — most of them Android TV set-top boxes — and quietly operated them as a botnet. According to The Verge, Google has since dismantled the botnet's command infrastructure, ended its relationship with the manufacturer, and banned Videostrong from building or selling certified Android devices or supplying software for them.

A backdoor baked into the firmware

According to a technical write-up published on dev.to, the implant is known as x.cpe and runs as a system-level app inside the device firmware, signed with the manufacturer's own key. Google says Videostrong used obfuscation so the malicious payload was fetched only after a device's first boot, which allowed it to slip through a gap in Google's compatibility and security testing.

Once running, the backdoor could switch off the app-verification checks in Google Play Protect, silently install applications, execute commands, capture the screen, log keystrokes, map the local network and open reverse shells into the box. Google says it observed operators taking live screenshots, injecting keystrokes, and exfiltrating account details, device information, app lists and system logs.

A business built on rented access

Google's central claim is that this was no accident. According to The Verge, Google assesses that the backdoor and botnet were intentionally developed, deployed and operated for financial gain: Videostrong sold access to criminal affiliates, who loaded their own malware modules onto infected hardware. Those modules ran ad fraud, silently enrolled boxes into residential proxy networks that sell household bandwidth, and installed still more malware. The dev.to write-up reports that affiliates loaded more than a dozen distinct malware families onto the devices.

The footprint extended well beyond living rooms. Google found the code built into many device models and brands over several years, including Android-based telehealth devices, karaoke machines and digital signage. TrendAI, described in the dev.to piece as Trend Micro's enterprise unit, counted 1,472,554 infected devices across 206 models between June 3 and October 1, and says the real figure is at least that high — somewhat above Google's 1.3 million. Malaysia, Brazil, Iraq, Mexico and Taiwan led the count, with the US, Germany, the UK, Australia and Canada each registering roughly 26,000 to 42,000 infections.

The case against Videostrong

The attribution, as laid out in the dev.to analysis, rests on several threads. Google found that x.cpe passes settings to other Videostrong apps, including its YokaTV Player, and that a GitHub account hosting botnet packages is named yf-videostrong. Synthient, which worked with Google, reached the same conclusion with high confidence, citing a document signed by Videostrong's research and development director left in an open folder on one of the botnet's servers, and a Videostrong web domain sharing an IP address with the operators' control panel. Plume found that Videostrong supplies both the firmware for these devices and the tools to manage them remotely, and that most of the hardware contacting the command servers was MECOOL-branded. Synthient bought a MECOOL KM9PRO Max at retail and found the backdoor preinstalled out of the box.

The takedown and its limits

Google led the disruption alongside Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, using legal action to seize the botnet's domains and servers as well as the control domains of the affiliate malware families. Because those affiliates also spread their modules through other channels, Google estimates the action severs access to at least 10 million additional compromised devices, though it warns that operators and their customers tend to move to new infrastructure quickly.

What the seizure does not do is clean the hardware. Because x.cpe lives in firmware signed by the manufacturer and reinstalls after every reboot, TrendAI says remediation requires vendor action, platform-level protection or outright device replacement — awkward, given the vendor is the accused operator. Synthient's advice to consumers is to discard the boxes. Google acknowledges its own testing missed the scheme and says it has changed its review process and is strengthening firmware checks on certified Android TV devices. Plume notes the botnet covered both Google-certified devices and hardware running the Android Open Source Project, and as of November 2, per the dev.to write-up, Videostrong's website still advertised "Google Certified" TV products.

Why it matters

In Google's assessment, this was not a supply chain that got compromised — the supplier itself was the operator. That reframes several assumptions. A certification badge describes a device at the moment it was tested, and Videostrong allegedly timed its payload to activate after that moment. White-label manufacturing means the logo on a box says little about who wrote its firmware, and Synthient cautions that a model name alone neither confirms nor rules out infection. More than a million signed, self-reinstalling backdoors remain in homes, clinics and businesses, and Google's ban only covers future certified products. Finally, with so many boxes sold as residential proxies, fraud and scraping traffic was engineered to look like it came from ordinary households — a reason for defenders to stop treating a clean residential IP address as strong evidence of a legitimate user.