Home · Technology · Nov 2 archive
Google Banned Videostrong After 1.3M Android Devices Turned Into Botnet
· Confirmed
In Short: Google has banned Videostrong Technology Co., a Chinese manufacturer, from building or selling any certified Android devices after discovering the company secretly embedded backdoors into 1.3 million devices.
Google has banned Videostrong Technology Co., a Chinese manufacturer, from building or selling any certified Android devices after discovering the company secretly embedded backdoors into 1.3 million devices.
According to Google Cloud's threat intelligence team, the backdoor and botnet were 'intentionally developed, deployed, and operated for financial' purposes.
The botnet, called XCPE, was used for ad fraud, data theft, and routing malicious traffic through residential proxy networks.
The botnet's sudden surge in activity between November 19 and 22, issuing 1.7 billion DDoS attack commands, was noted by 奇安信X 实验室.
The botnet primarily consisted of Android TV set-top boxes, but also included telehealth devices, karaoke machines, and digital signage devices.
Google said it has now dismantled the backdoor and 'cut ties' with Videostrong, which has been banned from building or selling certified Android devices or supplying software to other certified vendors.
The scale of the operation suggests sophisticated planning and infrastructure, with Videostrong embedding the backdoors into devices during manufacturing.
Google has taken legal action to block the domains and servers that Videostrong was using to control the XCPE botnet and malware modules.
Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.
The incident highlights the importance of trust in consumer electronics and the potential risks of supply chain security breaches in the Android ecosystem.
Background
Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.
What's confirmed
- Google is dealing with one of the most brazen supply chain attacks in Android's history.
- According to Google Cloud's threat intelligence team, the backdoor and botnet were "intentionally developed, deployed, and operated for financial" purposes.
- The company revealed that Videostrong Technology Co., a Shenzhen-based manufacturer of Android TV set-top boxes, deliberately embedded backdoors into 1.3 million certified devices and operated them as a botnet without users' knowledge or consent.
- Google Bans Partner After 1.3M Android Boxes Turned Botnet Videostrong secretly built backdoors for ad fraud and data theft in certified devices Google just severed ties with a Chinese manufacturing partner after discovering the company secretly turned 1.3 million Android set-top boxes into a massive botnet.
- Google and an assortment of partners shut down a botnet that an approved Android device manufacturer purposefully deployed across more than 1.3 million TV set-top boxes, the company said Monday.
- The botnet spanned more than 170 countries, with the largest concentration of infected devices based in Malaysia, Brazil, Iraq, Mexico and Taiwan, according to TrendAI researchers.
- The company says it has now dismantled the backdoor and “cut ties” with the manufacturer, the Shenzhen, China-based Videostrong Technology Co., which has been banned from building or selling certified Android devices or supplying software for them.
- On November 30, we captured another new sample of this botnet family and successfully took over one of the C2 domains, thereby obtaining the opportunity to directly observe the true operating scale of this botnet for the first time.
- Although most infections involved TV boxes, researchers also identified compromised telehealth equipment, karaoke machines, and digital signage devices.
- Google has cut ties with the company and banned it, along with future subsidiaries and affiliates, from producing certified Android devices or supplying software to other certified vendors.
- On October 24, 2025, a trusted partner in the security community provided us with a brand-new botnet sample.
- Most of the devices comprising the XCPE botnet were Android TV set-top boxes, but researchers also observed infected Android-based telehealth devices, karaoke machines and digital signs.
What's still developing
- This Android fork has an uncompromising focus on security and privacy to the point where it only supports a limited number of phones – if a phone is missing a hardware feature that is vital for security, it doesn’t get a GrapheneOS port.
- Googlebook introduces a new category of laptops built on a shared Android foundation.
- Android’s smartwatch options got a major new addition at IFA 2026, as Motorola has just launched the new Moto Watch Ultra.
- A Motorola-partnered creator video lists 16GB of RAM, a 200MP periscope and Android 17, but there’s still no UAE price or date.
- It runs Android 17 out of the box and gets seven years of OS updates.
- At the Android Dev Summit on Wednesday, Google’s smart glasses partner Xreal launched its new Xreal Aura wired smart glasses, powered by the Android XR and Qualcomm’s Snapdragon Reality Elite platforms.
- Much like it did with Android smartphones, Google is relying on an assortment of partners, including Samsung and Xreal, to bring devices powered by its Android XR platform to consumers.
- "Developers integrate with a cloud-hosted MCP server or Android MCP using the AppFunctions APIs, then use the Google Connected Console to register, test, and submit their app," according to Google.
- Developers plug in via a cloud MCP server or Android AppFunctions and pick Search, Gemini or both.
- Googlebook is a new laptop category launched by Google, featuring the deep integration of the Android ecosystem, Gemini AI, and PC experiences.
- This partnership expands Qualcomm’s PC chip market beyond Windows into the Android-based ecosystem, providing a new growth avenue amid pressures in its mobile chip business from Apple’s in-house modem development.
- It runs on Googlebook OS, built on the Android technology stack, supports Android apps, and enhances file, application, and task collaboration with Android phones.