Google Says Videostrong Built a 1.3 Million-Device Android Botnet Into Its Own TV Boxes

TL;DR

• what: Google, with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, took down the control servers of a 1.3 million-device Android botnet and says Shenzhen device maker Videostrong intentionally built the x.cpe backdoor into its boxes.
• impact: Operators could silently install apps, run commands, capture screens, steal account details and open reverse shells, and criminal buyers turned the boxes into residential proxies and ad fraud engines across 206 models.
• fix: There is no patch: x.cpe lives in firmware signed with the maker's key and reinstalls on reboot, so TrendAI says cleanup needs vendor action, platform protection or device replacement, while Google has banned Videostrong from certified Android.
• who: Owners of Videostrong-built and MECOOL-branded Android TV boxes, plus organizations whose remote staff, telehealth, signage or guest networks carry cheap Android hardware.

In late October, more than 1.3 million Android devices, most of them TV set-top boxes sitting in ordinary homes, lost contact with the servers that controlled them. Google led the takedown. The harder finding came with it: Google says it is highly confident that the device maker, Videostrong of Shenzhen, China, intentionally built the backdoor into its boxes and sold access to criminals.

This is not a story about a supply chain that got compromised. In Google's assessment, the supplier was the operator. Google does not believe a rogue insider or a mistake was to blame. The backdoor, called x.cpe, was built into many device models and brands over several years, and it is still on the boxes today. Owners cannot remove it themselves.

A product line built as infrastructure

According to Google's analysis, x.cpe runs as a system app inside the firmware with system-level access. It reports to the botnet's command-and-control servers and waits for orders. To install software silently, it first turns off the app checks in Google Play Protect. From there, operators could install apps without the owner knowing, run commands, capture the screen and map the network the box sits on.

Google says it watched Videostrong's operators use those powers: live screenshots, injected keystrokes, exfiltrated account details, device information, app lists and system logs, and reverse shells into the box. The criminals who bought access loaded more than a dozen malware families. Most of their modules turned the boxes into residential proxies or sold their spare bandwidth, so a customer's traffic appeared to come from a normal household. Other modules faked views of online ads.

The scale is broad and global. TrendAI, Trend Micro's enterprise business unit, counted 1,472,554 infected devices across 206 models between June 3 and October 1, and says the real number is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan led the count. The U.S., Germany, the U.K., Australia and Canada each had roughly 26,000 to 42,000. The backdoor also turned up outside the living room, on telehealth devices, karaoke machines and digital signage.

⚠️ A reboot brings it back — Because x.cpe is part of the firmware, removal does not stick: it reinstalls when the box restarts. TrendAI says it runs as a system app signed with the maker's key, so cleanup needs "vendor action, platform protection or replacement of the device." In this case the vendor is the party Google says built the backdoor. Synthient tells consumers to throw the boxes away for good.

How the attribution was built

The case against Videostrong rests on several independent threads. Google found that x.cpe passes settings from the C2 server to other Videostrong apps, including its YokaTV Player streaming app, and that one GitHub account hosting the botnet's packages is named yf-videostrong. Synthient, which worked with Google, reached the same conclusion with high confidence. It points to a document signed by Videostrong's research and development director sitting in an open folder on one of the botnet's servers, and to a Videostrong web domain sharing an IP address with the operators' control panel.

Plume found that Videostrong supplies both the firmware for these devices and the tools to manage them remotely, and saw more than a dozen distinct devices talking to the botnet's control server, most of them MECOOL-branded. Synthient links MECOOL to Videostrong and bought a MECOOL KM9PRO Max to confirm it: the backdoor was preinstalled out of the box.

The takedown and its limits

Google used legal action to seize the domains and servers that controlled the botnet, along with the control domains of more than a dozen malware families loaded through the backdoor. Because those criminals also spread their malware by other means, Google expects the action to cut off access to at least 10 million more infected devices. It also warns that backdoor operators and their customers switch to new tools quickly when one piece of their setup is disrupted.

Google has cut ties with Videostrong and banned it, and any future subsidiaries or affiliates, from building or selling certified Android devices and from supplying software to other certified makers. It also admits a process failure: Videostrong hid its code to slip through a gap in Google's compatibility and security tests, loading the malicious payload after the device's first boot. Google says it has changed its review process and is improving firmware checks on certified Android TV devices. Plume says the botnet included both Google-certified devices and devices running the Android Open Source Project build. As of November 2, Videostrong's own website still listed products it calls "Google Certified Android TV Box" and "Google Certified Android TV Stick."

The RedEye take

The takedown is good work, and the multi-party coalition behind it is the model for how these operations should run. But be clear about what it did and did not do. It cut the leash. It did not remove the dog. More than a million boxes still carry a signed, self-reinstalling backdoor, and the operator Google named is the only party with the signing key. The ban stops future certified products; it does nothing for hardware already in homes and clinics.

The deeper lesson is about trust labels. A certification badge describes a device at the moment it was tested. Videostrong, per Google, designed its code to activate after that moment. White-label manufacturing compounds the problem: Videostrong builds under its own name and for other brands, so the logo on the box says little about who wrote the firmware. Synthient's list of 182 model names carries its own warning that a model name alone does not confirm infection. When the vendor is the threat, the usual signals of legitimacy are exactly what gets weaponized.

The real product was your neighbor's IP address — Most criminal modules sold residential proxy access. That means a large volume of fraud, credential abuse and scraping traffic was designed to look like it came from ordinary households in the U.S., Germany, the U.K. and elsewhere. A clean residential IP is not evidence of a legitimate user.

What defenders should learn

• Firmware provenance is a procurement decision, not a patching decision. When the firmware signer is the operator, no update path exists, so the question to answer before purchase is who builds and signs the firmware, not whose brand is on the box.
• Downgrade residential IP reputation as a trust signal. With proxy modules sold across more than a million homes, risk scoring that treats household addresses as low risk is scoring in the attacker's favor.
• Read certification as a point-in-time check. Google's tests missed code loaded after first boot, and certified devices were in this botnet. Vendor-supplied trust badges deserve the same skepticism as any self-attestation.
• Remote work extends your perimeter into living rooms. TrendAI advises treating unmanaged consumer devices on home networks as attack surface and keeping corporate access behind managed devices, and Synthient advises keeping smart devices on segments away from sensitive systems.
• Look past the TV box. The backdoor appeared on telehealth devices and digital signage, categories that healthcare, retail and hospitality teams often buy on price from white-label Android suppliers and rarely inventory as endpoints.

Bottom line

Google disrupted the command layer of a 1.3 million-device botnet and, by extension, cut criminals off from at least 10 million more devices. The hardware remains compromised, the operators are expected to retool, and the vendor Google named was still advertising Google-certified products on the day the story broke. Treat this as a case study in vendor trust, not a closed incident. Source: The Hacker News, "Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access," November 2, 2026.

Originally published on RedEye Threat Intelligence.