Google dismantles 1.3-million-device Android botnet built by Videostrong

Google dismantles 1.3-million-device Android botnet built by Videostrong

SAN FRANCISCO — Google has dismantled a botnet of 1.3 million Android devices, mostly TV set-top boxes, built by manufacturer Videostrong Technology, the company said Monday. The Shenzhen, China-based vendor intentionally embedded a backdoor called x.cpe into device firmware over multiple years, using obfuscation techniques to bypass compatibility and security tests, Google said.

The backdoor was preinstalled on devices at the factory and activated after the hardware's first boot, Google said. Once active, x.cpe reported to command-and-control servers and accepted instructions. Google's analysis found the backdoor was used to disable Google Play Protect, install applications silently, capture live screenshots, send keystrokes, extract account details and device information, and open reverse shells giving remote command-line access to the boxes.

Google said the operators monetized the infected devices through multiple modules. Residential proxy and bandwidth-sharing modules included Linkfog, Jagular, AppSalt, BWM/IPWeb, GaGaNode, NetNut/PopaNet, Traffmonetizer and EarnFM/FleetSDK. Ad-fraud modules loaded through the backdoor included Spirit, Moyu, Bird and Fission.

Google, working with Japan's National Police Agency and private-sector partners Lumen, Human Security, Plume, Synthient and TrendAI, seized control domains and disrupted the command-and-control infrastructure. Google has cut ties with Videostrong and banned the company, its subsidiaries and any future affiliates from building or selling certified Android devices or supplying software to certified vendors.

Because the criminal affiliates have diversified distribution channels beyond the XCPE backdoor, Google assesses the takedown will sever access to at least 10 million additional compromised devices.

Affected device models span MECOOL and other brands, including Android TV set-top boxes, telehealth devices, karaoke machines and digital signage. Google says the backdoor runs as a system app signed with the maker's key, making it impossible for owners to remove; it reinstalls upon device restart.

Google said it has updated its review process and is improving its checks of the firmware on certified Android TV devices. As of November 2, Videostrong's own website listed products it calls "Google Certified Android TV Box" and "Google Certified Android TV Stick." Google's report does not say how many certified devices were affected.

When Google sued over the BadBox 2.0 botnet in July 2025, the more than 10 million devices involved were uncertified.