1.3 Million Android Set-Top Box Botnet: Google Accuses Partner Videostrong

Google says Videostrong Technology, a Shenzhen-based manufacturer and Android device development partner, secretly built a backdoor, meaning a hidden access point, into 1.3 million devices, turning them into a botnet.¹ A botnet is a network of infected devices controlled remotely, in this case by command servers. Google says it has shut down the backdoor and “terminated its relationship” with the company, which can no longer manufacture or sell certified Android devices or supply their software.¹²

What happened and which devices are affected

The network is called XCPE and, according to Google, was made up mostly of Android TV set-top boxes. The malware was built into many different models and brands, sold over several years.¹² The infected devices also include Android telemedicine devices, karaoke machines and digital signage screens.¹ According to The Register, cited by t3n, the affected devices are in more than 200 countries, including Germany. Infobae lists Spain, the United Kingdom, the United States, Russia, Brazil, Canada and Australia, among others.³⁴ According to Google, Videostrong used obfuscation techniques, that is, techniques for disguising code, to load the malware after the device’s first startup.¹ 01net reports that the backdoor, called x.cpe, had the highest privileges on the system and reinstalled itself on reboot even if removed. Buyers therefore had little chance of getting rid of it.²

How Videostrong made money from the backdoor

Google maintains that the backdoor and botnet were developed and run for profit. According to the company, Videostrong sold access to criminal affiliates and loaded their malicious modules onto the devices.¹ These modules were used for ad fraud, for enrolling the devices in residential proxy networks and for installing other malware. With a residential proxy, malicious traffic is routed through the home connection of the unsuspecting owner, which hides its origin.¹³ Google also cites data exfiltration, meaning the theft of information from the devices, and the routing of unauthorized network traffic. All of this happened without the owners knowing.¹ TrendAI, a security company involved in the case, explained that the malicious agent presented itself as a normal remote maintenance client. Updates came from a GitHub page created for the purpose.³

How the network was dismantled

According to 01net, a few days before the announcement Google took control of the servers that directed the network. The company acted together with Japan’s National Police Agency and security firms, and the investigation was carried out by the Google Threat Intelligence Group, its threat analysis team.² Infobae lists Lumen, HUMAN Security, Plume, Synthient and TrendAI among the partners.⁴ Google also disrupted the command-and-control domains used by the affiliates’ modules. It estimates that this move cuts off access to at least another 10 million compromised devices, because those affiliates also distribute the modules through other channels.¹ Following the case, Google adds, it has changed the vetting process for device manufacturers.¹

What is confirmed and what is not

The accusations against Videostrong come from Google, and the sources consulted report them as such. The articles do not contain a response from the Chinese company.¹² Google rules out that this was the act of an isolated employee or a development error, and describes it as an operation intended by the company.²⁴ t3n recalls that in 2025 Google, with Human Security and TrendAI, dismantled the BadBox 2.0 botnet, made up of more than 10 million Android TV set-top boxes and other devices. According to t3n, the new network may come from the same circle as the people behind that one, though it presents this only as a possibility.³

What users can do

Google advises caution with apps that promise payment in exchange for your “unused bandwidth” or for sharing your connection. According to the company, they are a main route of growth for illicit proxy networks and can create vulnerabilities in the home network.⁴

This article was written by artificial intelligence from the sources cited, without human review. Automatic newsroom by Redazia.

Sources

Footnotes

1. One of Google’s Android partners turned 1.3 million set-top boxes into a botnet, The Verge, 2026-11-02 ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹

2. 1,3 million de boîtiers TV Android piratés : Google démantèle un botnet chinois, installé dès l’usine par un fabricant, 01net, 2026-11-03 ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

3. 1,3 Millionen Settop-Boxen betroffen: Google-Partner verwandelte Android-TV-Geräte in Botnet, t3n, 2026-11-03 ↩ ↩² ↩³ ↩⁴

4. Google desmantela una botnet de 1,3 millones de decodificadores creada por un socio de Android, Infobae, 2026-11-03 ↩ ↩² ↩³ ↩⁴