Google Bans Videostrong After 1.3 Million Android TV Boxes Turned Into Botnet

Google announced on Monday that it has shut down a botnet that operated on more than 1.3 million Android TV boxes. The malware, called x.cpe, was built into devices by Shenzhen-based Videostrong Technology, a certified Android TV partner. The company sold access to the backdoor to criminal affiliates, who used the infected set-top boxes for ad fraud, residential proxy networks and remote data theft.

• 1.3 million devices infected, spanning 206 models and multiple brands.
• Videostrong was banned from producing certified Android devices and from supplying software to other certified makers.
• Google’s takedown also seized Videostrong’s command-and-control servers and dozens of malware domains, cutting off at least 10 million more potential victims.

How the Backdoor Operated

The x.cpe backdoor was embedded in firmware with system-level privileges. It disabled Google Play Protect, allowing it to install additional modules without user knowledge. Once installed, the malware could take screenshots, inject keystrokes, copy account details, and map the home network. Most infected units were set-top boxes, but the code also appeared on telehealth devices, karaoke machines and digital signage.

Scale of the Infection

TrendAI, the enterprise arm of Trend Micro, reported 1,472,554 infected devices across 206 models between June and October. The highest concentrations were in Malaysia, Brazil, Iraq, Mexico and Taiwan. In the United States, Germany, the United Kingdom, Australia and Canada, each country had between 26,000 and 42,000 infected units.

Google’s Response and Legal Actions

Google worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI to dismantle the operation. Legal action was taken to seize Videostrong’s control servers and to shut down the command-and-control domains of more than a dozen malware families that were distributed through the backdoor. The company expects the takedown to isolate at least 10 million more devices that could have been compromised.

Implications for Certified Android Devices

Videostrong was a certified Android maker, meaning its devices passed Google’s compatibility and security tests. The company hid the malware in a way that exploited a gap in Google’s testing, loading it after a device’s first boot. In response, Google has revised its review process and is strengthening firmware checks for certified Android TV devices. The incident highlights the risk that even trusted OEMs can introduce malicious code into the supply chain.

What Comes Next for Owners and Developers

Owners of infected devices cannot remove the backdoor themselves, as it runs as a system app signed with Videostrong’s key. Synthient has published a list of 182 model names linked to the campaign, but a model name alone does not confirm infection. Developers and IT teams should verify firmware integrity, monitor for unusual network activity, and consider replacing affected hardware. Google’s ban on Videostrong and its affiliates signals a stricter stance on certified device manufacturers that violate security standards.