Google has disrupted a botnet of more than 1.3 million Android devices, mostly TV boxes, and banned the maker, Videostrong, from its certified Android program. Google says the company built the backdoor on purpose.
However, the fix is only partial. The control servers lost power in late October, but the backdoor remains. Google shared the news on November 2.
Why Google banned TV box maker, Videostrong
Videostrong is based in Shenzhen, China. It sells TV boxes under the MECOOL brand and builds devices for other labels. Google’s threat team has high confidence that the company created and ran the botnet for profit. Google does not believe a rogue employee or a mistake caused it.
The backdoor is called x.cpe. It lives in the firmware, which is the core software on the device. As a result, it has deep access. It can switch off the app checks in Google Play Protect. Then it installs apps without the owner knowing.
Google also saw the operators use these powers. They took live screenshots, sent keystrokes and copied account details. They also opened remote command lines into the boxes.
How the criminals made money turning TV boxes into botnets
Most add-on programs turned the boxes into residential proxies. A residential proxy sells access to a home internet connection. A buyer’s traffic then looks like it comes from an ordinary household. Other programs faked views of online ads. Advertisers therefore paid for traffic that no person saw.
Chinese threat actors have also used proxy networks to conceal their activity. The UK has warned about Chinese hackers using these networks to evade detection and make their operations harder to trace.
Most infected devices are TV boxes. Still, the backdoor also turned up on telehealth devices, karaoke machines and digital signs.
Google counts more than 1.3 million devices. TrendAI, a Trend Micro business unit, found 1,472,554 infected devices across 206 models between June 3 and October 1. It says the real number is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. Meanwhile, the U.S., Germany, the U.K., Australia and Canada each had roughly 26,000 to 42,000.
What Google did
Google took legal action against the domains and servers that ran the botnet. It also hit the control domains of more than a dozen malware families loaded through the backdoor. Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI helped.
Those criminals also spread their malware in other ways. Because of that, Google expects to cut their access to at least 10 million more infected devices. Google warns, however, that such groups switch tools quickly.
Google also cut ties with Videostrong. The ban covers future subsidiaries and affiliates. The company can no longer build certified Android devices or supply software to certified makers.
How investigators identified the company
Several clues pointed to Videostrong. The backdoor passed settings to other Videostrong apps, including its YokaTV Player. One GitHub account that hosted the botnet’s files was named yf-videostrong.
In addition, Synthient found a document signed by Videostrong’s research director in an open folder on a botnet server. A Videostrong web domain also shared an IP address with the operators’ control panel.
Google says Videostrong exploited a gap in its certification tests. The company hid its code and loaded the harmful parts only after a device’s first startup. Google has since changed its review process. It is also tightening firmware checks on certified Android TV devices.
Plume found that the botnet included both Google-certified devices and open-source Android builds. Google’s report does not say how many certified devices were hit. Notably, Videostrong’s website still advertised a “Google Certified Android TV Box” on November 2.
What owners can do
The backdoor is part of the firmware, so deleting it does not last. It reinstalls when the box restarts. TrendAI says a cleanup needs action from the maker, platform protection or a new device.
Plume recommends a full factory reset. However, it does not say whether a reset removes x.cpe itself. Synthient goes further and tells consumers to throw the boxes away.
Synthient also published a list of 182 model names seen in the campaign. A model name alone does not prove infection. Its report focuses on MECOOL boxes, and it found the backdoor preinstalled on a MECOOL KM9PRO Max. If your box matches the list, stop using it.
Companies should take care too. TrendAI advises firms with remote staff to treat unmanaged home devices as part of their attack surface.
Why this case stands out
This is not Google’s first fight over TV box botnets. In July 2025, it sued over BadBox 2.0, a botnet of more than 10 million uncertified devices. This case differs. Here, Google says a company inside its own certified program built the backdoor. Also, there’s no response from Videostrong regarding the case for now.
