Google says Chinese TV box maker Videostrong built a backdoor into 1.3 million devices, bans it

Google says a company it certified to make Android TV boxes was the one that infected them.

In a report published today, Nov. 2, Google's Threat Intelligence Group said it assesses "with high confidence" that the XCPE backdoor and botnet were "intentionally developed, deployed, and operated for financial gain" by Videostrong Technology Co., an Android device maker based in Shenzhen, China. More than 1.3 million set-top boxes were enrolled.

Google and industry partners dismantled the botnet's command infrastructure last week.

How the backdoor worked

Most botnets get in through software flaws or by tricking users. This one shipped inside the firmware.

Google says the main component, tracked as x.cpe or com.oemservice, runs with system-level privileges. It was found built into many device models and brands over multiple years. Videostrong makes boxes under its own MECOOL brand and builds devices for other labels.

The backdoor switches off Google Play Protect's app verification so it can install software silently. Operators could run commands, capture the screen, map the home network and open a remote shell. Google says it saw Videostrong's operators take live screenshots, inject keystrokes and copy out account details, app lists and system logs.

Deleting the app does not fix the box. It reinstalls itself from a protected partition on the next reboot.

Since August 2026, operators have also pushed droppers disguised as system packages. They use a privilege escalation exploit to write into the system partition, which makes them harder to dislodge.

Selling access to the living room

Google's account is a business model, not a one-off intrusion. Videostrong sold access to criminal affiliates, who loaded their own modules onto the boxes.

Those modules faked ad views, enrolled devices as residential proxies and installed more malware. A residential proxy lets a customer's traffic appear to come from an ordinary household, so the box owner's internet connection carries someone else's traffic.

Most infected devices are Android TV boxes. Google also found the backdoor on telehealth devices, karaoke machines and digital signage.

Google says it also took down command domains for more than a dozen malware families loaded through the backdoor. Because those affiliates distribute through other channels too, Google estimates the action cuts criminal access to at least 10 million additional compromised devices. Those came in through other routes, and not all are Android.

The evidence Google cites

Google says it does not believe this was a rogue insider or a development oversight. It points to dedicated infrastructure and configurations that kept changing to evade detection and manage affiliates.

The company tied x.cpe to Videostrong's own YokaTV Player app and to a GitHub account named yf-videostrong that hosted payloads. The malware also checks whether a device identifies itself as a Mecool model.

Synthient, one of the partners, reached the same high-confidence conclusion. It cited a document signed by Videostrong's R&D director, found in an open folder on a botnet server. A Videostrong domain also shared an IP address with the operators' control panel.

Those are Google's and its partners' findings. No criminal charges against Videostrong or its executives have been announced.

The scale

TrendAI, Trend Micro's enterprise business unit, counted 1,472,554 infected devices across 206 models between June 3 and October 1. It calls every figure a lower bound.

Malaysia, Brazil, Iraq, Mexico and Taiwan led the count. The U.S., Germany, the U.K., Australia and Canada each logged roughly 26,000 to 42,000.

Google worked on the operation with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. It used legal action to take down the domains and servers that controlled the botnet and delivered the modules.

Google's own gap

These boxes carried Google's certification, and buyers had reason to treat that as a mark of safety.

Google concedes Videostrong "employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device's first boot." Passing Google's compatibility and security checks did not mean the shipped product was clean.

The company says it has changed its manufacturer review process and is tightening firmware integrity checks on certified Android TV devices. It has cut ties with Videostrong, revoked its ability to make devices with preloaded Google apps, and barred the company and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified makers.

The case echoes BadBox 2.0, the preinfected streaming-box botnet the FBI warned about in 2025. The difference here is the certification.

What owners face

Cutting the botnet off from its servers does not remove the code. Owners cannot strip the backdoor themselves, and a simple uninstall will not clear it.

The options for people holding an affected box are clean firmware, disconnecting it from the internet, or replacing it. Google advises buying from reputable manufacturers listed on its Android TV partner page, keeping Play Protect on, and avoiding apps that pay users to share spare bandwidth.

Google itself warns that takedowns like this are temporary. Backdoor operators, ad-fraud rings and residential proxy providers work as an interconnected supply chain, and Google says operators and their buyers quickly move to new tools when one piece is disrupted.

What remains unclear is the hardware already in homes. Google has not said whether Videostrong or any brand selling its boxes will push clean firmware to the 1.3 million-plus devices, or whether owners are simply expected to buy new ones.