Google has banned Shenzhen-based Videostrong Technology from its certified Android program after discovering that 1.3 million of the company’s TV boxes shipped with a firmware-level backdoor called XCPE, which the manufacturer allegedly sold to criminal groups for ad fraud and residential proxy networks, BGR reported.
The disruption, executed last week alongside Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient, and TrendAI, severed command-and-control domains that Google says managed the botnet since at least June 2026, cutting criminals off from at least 10 million additional compromised devices.
How XCPE Infiltrated Google’s Certified Ecosystem
XCPE came preloaded in the firmware of infected boxes and runs with system-level privileges, disguising itself under innocuous package names like “com.oemservice” and, since August 2026, “com.android.system.ntp.” Synthient first identified the backdoor on a Mecool KM9PRO Max purchased in late 2025, finding it already active under the guise of a standard OEM service before the device completed its initial setup.
Each startup triggers the malware to transmit serial numbers and MAC addresses to Videostrong’s servers via an MQTT messaging protocol, then await remote commands. The firmware’s pre-installed management agent pulled updates from a GitHub page, according to TrendAI, giving operators full remote control to install apps, execute shell commands, and push configuration changes without user knowledge.
Videostrong allegedly hid the code from Google’s compatibility and security tests by loading it only after initial certification—a gap Google says it has now closed in its review process. Google’s Threat Intelligence Group assessed with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology, The Register reported:
“We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology.”
Inside the Criminal Economy of Stolen Bandwidth
The buyers were criminal affiliates who paid Videostrong to install additional malware modules onto the boxes. These operators monetized the devices through residential proxy networks—selling access to home internet connections so that illicit traffic appears to originate from ordinary households—and large-scale ad fraud schemes. Google found as many as three residential proxy SDKs running simultaneously on single devices.
Google says the company that made your TV box sold access to it to criminals. The company is Videostrong, a TV-box maker in China. It put a backdoor in its own devices. More than 1.3 million boxes were taken over. Through the backdoor, they could: → install apps without you… pic.twitter.com/rT3BpnQoLH
On some boxes, operators went further, taking live screenshots, harvesting account credentials and app lists, copying system logs, and opening reverse shells for persistent command-line access. TrendAI documented more than 3.8 million distinct home and mobile IP addresses connecting to the operation between June 3 and October 1. Roughly half a million of the 1.3 million boxes still contacted command servers daily as of early November, concentrated in Malaysia, Mexico, and Brazil but present in the U.S. as well.
The infection extended beyond living-room entertainment into sensitive infrastructure. Google found XCPE on telehealth devices, karaoke machines, and digital signage—hardware categories where a silent backdoor poses risks extending beyond financial fraud into potential surveillance of medical or business environments.
Why Google’s Certification Shield Failed
Videostrong held official Android certification, meaning its devices passed Google’s compatibility and security testing before shipping with Google apps preloaded. The Times of India reported that the company used obfuscation techniques to conceal XCPE, triggering the payload only after users powered on their devices for the first time, making detection by automated testing nearly impossible.
Google has now barred Videostrong from building certified Android devices or supplying software to other certified manufacturers, effectively cutting the Shenzhen firm off from the Google Play ecosystem. The company also obtained court orders to shut down the domains and MQTT servers used to control the botnet, along with infrastructure behind more than a dozen malware families distributed through XCPE:
“Because these affiliates each have diversified distribution channels for their modules beyond XCPE, we assess that taking down their C2 domains will sever access to at least 10 million additional compromised devices.”
The Persistence Problem: Why Uninstalling Won’t Save You
Owners cannot simply delete XCPE through normal means. Because the backdoor lives in the firmware with system-level access and is signed with the manufacturer’s key, removing the visible app triggers automatic reinstallation from the device’s read-only memory partition on the next restart. The malware can also disable Play Protect’s app verification, neutering Android’s built-in defense mechanism.
Synthient has published a list of more than 180 affected device models, including the KM9PRO, though a model number alone doesn’t confirm compromise. Security firms recommend checking whether your home IP appears in residential proxy databases and, more drastically, disconnecting suspect boxes from networks entirely while changing Wi-Fi passwords and updating router firmware to prevent lateral movement.
Google TV Program Breaches Supply-Chain Security
This campaign sits within the same criminal ecosystem as BadBox 2.0, a botnet that infected over 10 million TV boxes before Google, HUMAN, and TrendAI disrupted it in March 2025. When Google sued over BadBox 2.0 in July 2025, all involved devices were uncertified AOSP builds—making Videostrong’s infiltration of the certified Google TV program a distinct escalation in supply-chain attacks, as The Hacker News noted.
The Deccan Herald reported that Videostrong did not immediately respond to inquiries about the allegations. This marks the second major disruption of 2026 for Google, following its January takedown of IPIDEA, a residential proxy network running on millions of devices.
‼️ BREAKING – Google disrupts a 1.3 million-device Android botnet and bans TV box maker Videostrong. Google says the company deliberately built a backdoor into its devices and sold access to criminals. The control servers are down. The backdoor is still there. Full story:… pic.twitter.com/J5JMXBFmun
More on Android
Google Disrupts 1.3 Million-Device Android TV Botnet, Exposing Firmware Security Risks Google has disrupted a botnet involving more than 1.3 million Android set-top boxes, exposing a security risk that goes beyond malicious apps: a backdoor embedded in device firmware. Google's… pic.twitter.com/CTCAGq9F66
Your Android TV box could be secretly working for hackers. Google has disrupted a massive botnet involving 1.3 million devices and banned Chinese TV box maker VideoStrong. The worrying part? Some infections may survive a factory reset. Is your device at risk? Read more:…
