Google Bans Videostrong After Backdoor Infected 1.3 Million Android TV Boxes

Cheap Android TV boxes have become one of the quietest pieces of infrastructure in the modern home. They sit under televisions, stay powered for years, receive little scrutiny and are bought largely on price. For a certain class of buyer, the presence of Google apps and the Google logo on the packaging is the only security assurance available. That assurance rests on a certification program that tests hardware and software before a product reaches shelves.

The economics of that hardware are unforgiving. Margins on a streaming box are thin, and manufacturers compete on components and volume rather than on security engineering. At the same time, an always-on device sitting behind a residential internet connection has real value to criminal groups. It can serve ads that nobody sees, route other people's traffic through a home IP address, or host additional malware. The result is a market in which the party that builds the device and the party that profits from abusing it can be the same company.

On November 2, 2026, Google Threat Intelligence Group said it had dismantled a backdoor called XCPE that had enrolled more than 1.3 million Android set-top boxes worldwide into a botnet. The same announcement banned Shenzhen-based Videostrong Technology Co. from building certified Android devices. It is a rare case in which the alleged operator is not an anonymous crime group but an approved manufacturer inside the supply chain.

The disclosure reframes a familiar story about insecure consumer gadgets. This was not a vulnerability that a manufacturer failed to patch. According to Google, the backdoor was designed, shipped and operated on purpose.

Key Facts

The Google Cloud Blog reported on November 2, 2026 that Google assesses with high confidence that the backdoor and the botnet were intentionally developed, deployed and operated for financial gain by Videostrong Technology Co., a Shenzhen-based Android original equipment manufacturer and original design manufacturer. Google said Videostrong monetized the access by selling it to criminal affiliates and by loading their malware modules onto infected devices. Those modules carried out ad fraud, silently enrolled devices into residential proxy networks and pulled down additional malware.

Scale is the defining feature of the case. Ars Technica reported on November 3, 2026 that at its height the malware, tracked as x.cpe, ran on more than 1.3 million Google-certified Android TV devices, mostly sold under the MECOOL brand. The figure is large enough that the infected population resembles a small country's worth of always-on endpoints. CyberScoop reported on November 2, 2026 that the botnet spanned more than 170 countries and that nearly 44,000 infected devices were based in the United States between June and October 2026.

Independent measurement came in higher than Google's own number. Ars Technica reported that Trend Micro counted 1,472,554 infected devices, with the overwhelming majority in Brazil, Malaysia, Iraq, Mexico and Taiwan and tens of thousands more online in the United States, Germany, the United Kingdom, Australia and Canada. Security firm Synthient published a list of 182 device model names known to be in the botnet, a catalogue that shows how widely the firmware was distributed. CyberScoop reported that researchers also observed infected telehealth devices, karaoke machines and digital signs, which extends the problem beyond televisions.

The technical design was modular. Google described a three-stage architecture. A stub called x.cpe, also packaged as com.oemservice, was preloaded in firmware and ran with android.uid.system privilege, the highest level available to a system component, and it reinstalled itself from the /oem/ partition after a user uninstalled it. A second stage, com.abc.nexus, acted as a loader and execution engine, shipped native anti-analysis utilities and included libseccomp_guard.so to block sandboxing. The third layer delivered monetization modules as native ELF daemons, embedded SDKs or secondary APKs.

Command and control was equally persistent. Devices used an HTTP POST bootstrap and then held a persistent MQTT connection to a server at mqtt.szbboys[.]com. The topics available to operators covered silent app installation, disabling Google Play Protect, arbitrary shell execution, screen capture, keystroke injection and network reconnaissance. Since August 2026, operators pushed new droppers disguised as Android system apps, including one named com.android.system.ntp, carrying libexploit.so to restart adbd as root and install itself into /system/priv-app/.

Google's response went beyond domain seizures. The company said it cut ties with Videostrong and banned the manufacturer, along with any future subsidiaries or affiliates, from building and selling certified Android devices or supplying software to certified vendors. It took legal action against the domains and servers used to control the botnet and against command-and-control domains used by more than a dozen malware families. Partners included Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Charley Snyder, head of disruption operations at Google Threat Intelligence Group, told CyberScoop that the operators constantly evolved configurations to evade pre-launch and post-launch detections.

Analysis

The certification model assumes that a device can be assessed once, at approval, and trusted afterward. XCPE exploited the gap between that moment and the first boot. Google said Videostrong used obfuscation to slip past compatibility and security tests and loaded malicious code only after the device was set up and online, and that the company has changed its review process in response. The bigger picture here is that supply chain trust has to be continuous rather than a single gate, because the most dangerous code can arrive after the stamp of approval has already been granted.

The numbers also expose a measurement problem. Google's estimate of more than 1.3 million devices and Trend Micro's count of 1,472,554 do not agree, and the gap matters when remediation is planned. A takedown of command-and-control infrastructure stops new instructions, but it does not clean hardware. Ars Technica reported that Play Protect remains disabled and that inert system-level modules stay installed, so removal is not straightforward for ordinary owners. What this really means is that disruption and remediation are different problems, and only the first one was solved here.

The commercial logic explains why the case is not an isolated incident. Selling access to affiliates turns a one-time hardware sale into a recurring revenue stream, and the affiliates bring their own distribution. Google said that because those affiliates have channels beyond XCPE, taking down the command-and-control domains will sever access to at least 10 million additional compromised devices. That estimate describes a criminal supply chain in which one botnet is a node rather than the whole network, and in which a single manufacturer's decision can propagate across many unrelated malware operations.

The ban is a structural remedy, and that is both its strength and its limit. It removes a participant from the certified ecosystem rather than playing whack-a-mole with individual modules, and it extends to future subsidiaries and affiliates, which closes the obvious workaround of renaming the business. Yet Google declined to share specifics about its revised review process, telling CyberScoop it did not want to give threat actors insight. The judgement is defensible, but it leaves outside researchers unable to verify that the loophole is closed.

Why It Matters

Certification is one of the few signals a buyer can use. Consumers purchasing a cheap streaming box, hospitals deploying connected telehealth hardware and businesses installing digital signage all rely on the same assumption, that an approved device has been checked. XCPE shows that the assumption can fail at the level of the manufacturer itself, not merely at the level of a careless reseller or hijacked update server.

Residential proxy networks turn infected consumer devices into someone else's problem. Traffic that appears to come from a home connection can be used to obscure fraud, scrape sites or route attacks past geographic controls. When 1.3 million boxes sit in that role, the harm spreads far beyond the households that bought them, and the victims have no way to know their connection was used.

Google's own framing acknowledges the limits of the win. The company said the takedown seriously impacted more than a dozen malicious actors but warned that the underlying market for backdoors, ad fraud and residential proxy networks is resilient and operates as an interconnected supply chain. That is an unusually candid admission that removing one operator does not remove the demand that made the operation profitable.

Next Up

The next test is whether certification changes are audited rather than merely announced. Synthient's list of 182 model names gives researchers and buyers a starting reference, and continued scanning should show whether infected devices are being cleaned or simply left dormant. Google has said it changed its review process but has not described how, so independent verification will have to come from outside.

Longer term, the case is likely to become a reference point in debates about who bears responsibility for insecure connected hardware. Videostrong's devices were certified, sold under a well known budget brand and shipped for years before the takedown. The question that follows is not whether the ban was justified, but whether the certification regime that admitted those devices can be rebuilt to catch a manufacturer that is itself the adversary.