1.3M Android TV boxes shipped with a backdoor, Google says

Google says a TV box maker built a backdoor that enlisted more than 1.3M Android devices.

According to Google's Threat Intelligence Group, Shenzhen-based Videostrong built the XCPE botnet, which spanned more than 200 countries. Google says it assesses with high confidence that the backdoor and botnet were intentionally developed, deployed and operated for financial gain. Videostrong did not immediately respond to The Register's inquiries.

Google alleges the company sold access to criminal affiliates, who loaded modules for ad fraud, residential proxy enrollment and more malware. Synthient says it traced the backdoor to Videostrong after finding the malware preinstalled on a MECOOL KM9PRO Max TV box. Google, Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI disrupted the operation. Google banned Videostrong and its subsidiaries from making certified Android devices and says it has changed its review process for manufacturers.

The takedown did not remove the malware from infected devices, BleepingComputer reports. Owners would need to install clean firmware or disconnect the device from the internet. Watch for any response from Videostrong.

The facts we checked

According to Google's Threat Intelligence Group, as reported by BleepingComputer, The Register, The Verge and 9to5Google. Claims about Videostrong are Google's; Videostrong has not publicly responded in the sources.

1. Google's Threat Intelligence Group said: "We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co."Quote · BleepingComputer
2. The XCPE botnet comprised more than 1.3 million Android devices across more than 200 countriesFigure · The Register
3. Google alleges Videostrong, a Shenzhen, China-based manufacturer, sold access to the backdoor to criminal affiliates, who loaded modules for ad fraud, residential proxy enrollment and additional malware onto infected devicesAlleged · The Verge
4. Google cut ties with Videostrong and banned it and its subsidiaries from making certified Android devices, including devices with preloaded Google apps, and from supplying software to certified vendorsFact · 9to5Google
5. Google says the malware was "built directly into many different device models and brands over multiple years"Quote · BleepingComputer
6. The disruption involved Japan's National Police Agency and the security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI, with GoogleReported · BleepingComputer
7. Google says taking down the affiliates' command-and-control domains will sever access to at least 10 million additional compromised devicesFigure · The Verge
8. Google says Videostrong used obfuscation techniques to exploit a gap in its tests and load malicious code after a device's first boot; Google says it has changed its review process for device manufacturersFact · 9to5Google
9. TrendAI documented more than 3.8 million distinct home and mobile IP addresses connected to the operation between June 3 and October 1Figure · The Register
10. Synthient says it traced the XCPE backdoor to Videostrong after finding the malware preinstalled on a MECOOL KM9PRO Max Android TV box bought in late 2025Reported · BleepingComputer
11. BleepingComputer reports the takedown did not remove the malware from infected devices, which reinstalls itself from the /oem/ partition if removed; users would need to install clean firmware or disconnect the device from the internetReported · BleepingComputer
12. Videostrong did not immediately respond to The Register's inquiriesReported · The Register

Sources

• The VergeOne of Google’s Android partners turned 1.3 million set-top boxes into a botnet
• 9to5GoogleGoogle shuts down a sneaky malware backdoor on millions of Android TV and Google TV boxes
• The RegisterCops bust botnet of 1.3M infected Android TV boxes
• BleepingComputerGoogle disrupts million-device XCPE Android malware botnet, bans TV box maker