Google Dismantles 1.3 Million-Device Android TV Botnet Linked to Official Hardware Partner

Google has dismantled a persistent backdoor embedded in 1.3 million Android TV set-top boxes, severing a massive cybercrime network. The operation, executed in late October 2026, targeted the XCPE botnet. It represents a rare instance of a platform holder directly neutralizing a hardware supply chain threat at the manufacturer level.[1][3][4]

The culprit was not an external hacker, but an official hardware partner. Google attributes the malware with high confidence to Videostrong Technology Co., a Shenzhen-based manufacturer. The company allegedly built the backdoor directly into the firmware of its devices before they ever reached consumers, exploiting its trusted position.[1][3][4]

The disruption went beyond the initial 1.3 million infected streaming boxes. By dismantling the command-and-control infrastructure, Google estimates it cut off criminal access to at least 10 million additional compromised devices worldwide. The coordinated takedown involved Japan's National Police Agency and multiple private cybersecurity firms.[1][5]

Inside the XCPE backdoor

The malware, tracked internally as x.cpe, operated with deep system-level privileges that made it nearly impossible for users to remove. It was designed to survive factory resets by automatically reinstalling itself from a protected partition upon reboot. The code functioned as a silent, permanent gateway for secondary infections.[1][3][5]

Rather than launching attacks directly, Videostrong allegedly monetized the backdoor by selling access to criminal affiliates. These third parties pushed their own modules onto the devices, turning living rooms into residential proxy nodes. This allowed threat actors to route malicious internet traffic through ordinary household connections, masking their true locations.[1][4][5]

The backdoor's capabilities extended far beyond bandwidth theft. Operators could remotely disable Google Play Protect, capture live screenshots, and inject keystrokes into the interface. They also siphoned account details, device information, and system logs, effectively turning a cheap streaming box into a comprehensive surveillance tool inside the home.[1][3][4]

"We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.," the Google Threat Intelligence Group stated in its November 2 report. The company explicitly noted this was not a rogue insider or a development oversight.[1][3]

A marketplace for cybercrime

The affiliate modules transformed the infected hardware into a plug-and-play cybercrime platform. Some modules were dedicated entirely to ad fraud, generating fake impressions by loading hidden webpages and clicking advertisements in the background. Others installed secondary backdoors, such as Moyu and Spirit, which downloaded even more malicious payloads.[1][3]

Residential proxy services like Linkfog, AppSalt, and Traffmonetizer were heavily represented among the payloads. These services often market themselves as legitimate bandwidth-sharing applications, but on the XCPE botnet, they were installed silently. Users never consented to having their home networks commoditized and sold to anonymous third parties.[1][3]

"Compromised-device networks are sustained by profit: operators take control of devices and household connections without consent, then monetise that access through proxy services and various fraud activities," said Gavin Reid, CISO at HUMAN Security. He noted that disrupting the infrastructure raises the cost of operating these illicit networks.[5]

The scale of the infection highlights the vulnerability of the budget Internet of Things market. Trend Micro's enterprise unit, TrendAI, counted 1,472,554 infected devices across 206 models between June and October 2026. While mostly TV boxes, the backdoor also appeared in telehealth devices, karaoke machines, and digital signage.[4][5]

The infections were globally distributed, reflecting the broad reach of white-label electronics. Heavy concentrations were found in Malaysia, Brazil, and Mexico, alongside tens of thousands of compromised units in the United States, Germany, and the United Kingdom. The hardware was often rebranded and sold under various generic names.[4]

Severing the supply chain

In response to the breach of trust, Google has permanently banned Videostrong from the Android ecosystem. The manufacturer and any future subsidiaries are prohibited from building certified Android devices or supplying software to certified vendors. Google also revoked the company's existing licenses, cutting off its legitimate revenue streams.[1][3][4]

The tech giant took aggressive legal action to seize the domains and servers used to control the botnet. This infrastructure disruption is what crippled the affiliates' broader networks, neutralizing the command channels for over a dozen distinct malware families that relied on the XCPE backdoor for their operations.[1][3][5]

The incident exposes a critical gap in how Android TV devices were previously vetted. Videostrong reportedly used sophisticated obfuscation techniques to hide the malicious code during Google's compatibility and security tests. The malware was designed to remain dormant during certification, only activating after the device's first boot.[1][3][4]

Google claims to have updated its review process to close this testing gap and tightened firmware integrity checks for certified Android TV hardware. However, the company has not disclosed exactly how many of the 1.3 million infected devices carried official Google certification versus open-source Android builds.[1][4]

The unsolvable hardware problem

While the botnet's command structure is dead, the physical hardware remains compromised. Because the x.cpe backdoor is baked into the firmware and signed with the manufacturer's key, ordinary consumers cannot remove it. A standard factory reset will not purge the underlying malware from the protected system partition.[3][4][5]

Security firm Synthient, which traced the infrastructure to Videostrong after analyzing a MECOOL-branded TV box, advises consumers to permanently discard the affected hardware. Without a clean firmware update from a vendor that has already been banned, the devices remain an inherent security risk to the local network.[3][4]

The takedown is a significant victory, but it underscores the persistent danger of cheap, unbranded electronics. Consumers often purchase budget streaming boxes from third-party marketplaces without considering the software supply chain. When the manufacturer is the threat actor, standard antivirus protections are easily bypassed at the factory level.[1][4]

For now, the 1.3 million devices are stranded without their command servers, rendering the backdoor dormant but present. The operation demonstrates that while platform holders can dismantle the digital infrastructure of a botnet, cleaning up the physical hardware requires consumers to throw the infected boxes away.[1][4]