Home · Technology · Nov 2 archive
Google Bans Partner Over 1.3 Million Android Devices Turned Into Botnet
· Confirmed
In Short: Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.
Google has banned Videostrong Technology Co., a Chinese manufacturer, from building or selling any certified Android devices after discovering the company secretly embedded backdoors into 1.3 million devices.
According to Google Cloud's threat intelligence team, the backdoor and botnet were 'intentionally developed, deployed, and operated for financial' purposes. The botnet, called XCPE, was used for ad fraud, data theft, and routing malicious traffic through residential proxy networks.
Google and its partners dismantled the XCPE botnet, which had issued 1.7 billion DDoS attack commands between November 19 and 22. The botnet spanned more than 170 countries, with the largest concentration of infected devices based in Malaysia, Brazil, Iraq, Mexico, and Taiwan.
Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.
Google said Videostrong used obfuscation techniques to exploit a gap in its device security tests, allowing the TV box maker to load malware after the first boot. This sophisticated planning and infrastructure suggest a well-organized operation.
The botnet's sudden surge in activity was noted by 奇安信X 实验室, which captured a new sample of the botnet family on November 30 and successfully took over one of the C2 domains.
Google has now banned Videostrong from building or selling any certified Android devices, marking one of the most significant supply chain security breaches in the Android ecosystem's history. The company has also taken legal action to shut down the domains and servers Videostrong used to control the botnet.
The botnet's discovery undermines confidence in the entire Android ecosystem, as trust is everything in consumer electronics. Google's decision to ban Videostrong signals a commitment to maintaining security and integrity in its certified devices.
Google's Threat Intelligence Group disrupted XCPE, a botnet built predominantly from Android TV set-top boxes, and attributed the operation with high confidence to Videostrong Technology Co., a Chinese Android original-equipment manufacturer.
Synthient, which tracks proxy networks and botnets, has published a list of 182 device model names seen in the campaign.
The botnet's infrastructure included a document signed by Videostrong's research and development director in an open folder on one of the botnet's servers, and a Videostrong web domain that shares an IP address with the operators' control panel.
What this adds
The botnet's sudden surge in activity between November 19 and 22, issuing 1.7 billion DDoS attack commands, was noted by 奇安信X 实验室.
Google's ban on Videostrong is one of the most significant supply chain security breaches in the Android ecosystem's history, highlighting the need for robust security measures in device manufacturing.
What's confirmed
- Google is dealing with one of the most brazen supply chain attacks in Android's history.
- According to Google Cloud's threat intelligence team, the backdoor and botnet were "intentionally developed, deployed, and operated for financial" purposes.
- The company revealed that Videostrong Technology Co., a Shenzhen-based manufacturer of Android TV set-top boxes, deliberately embedded backdoors into 1.3 million certified devices and operated them as a botnet without users' knowledge or consent.
- Google Bans Partner After 1.3M Android Boxes Turned Botnet Videostrong secretly built backdoors for ad fraud and data theft in certified devices Google just severed ties with a Chinese manufacturing partner after discovering the company secretly turned 1.3 million Android set-top boxes into a massive botnet.
- Google and an assortment of partners shut down a botnet that an approved Android device manufacturer purposefully deployed across more than 1.3 million TV set-top boxes, the company said Monday.
- The botnet spanned more than 170 countries, with the largest concentration of infected devices based in Malaysia, Brazil, Iraq, Mexico and Taiwan, according to TrendAI researchers.
- The company says it has now dismantled the backdoor and “cut ties” with the manufacturer, the Shenzhen, China-based Videostrong Technology Co., which has been banned from building or selling certified Android devices or supplying software for them.
- On November 30, we captured another new sample of this botnet family and successfully took over one of the C2 domains, thereby obtaining the opportunity to directly observe the true operating scale of this botnet for the first time.
- Although most infections involved TV boxes, researchers also identified compromised telehealth equipment, karaoke machines, and digital signage devices.
- Google has cut ties with the company and banned it, along with future subsidiaries and affiliates, from producing certified Android devices or supplying software to other certified vendors.
- On October 24, 2025, a trusted partner in the security community provided us with a brand-new botnet sample.
- Most of the devices comprising the XCPE botnet were Android TV set-top boxes, but researchers also observed infected Android-based telehealth devices, karaoke machines and digital signs.
What's still developing
- This Android fork has an uncompromising focus on security and privacy to the point where it only supports a limited number of phones – if a phone is missing a hardware feature that is vital for security, it doesn’t get a GrapheneOS port.
- Googlebook introduces a new category of laptops built on a shared Android foundation.
- High-performance hardware from partners such as HP, Dell, Lenovo, Acer, and Asus, combines mobile convenience with desktop power.
- Android’s smartwatch options got a major new addition at IFA 2026, as Motorola has just launched the new Moto Watch Ultra.
- A Motorola-partnered creator video lists 16GB of RAM, a 200MP periscope and Android 17, but there’s still no UAE price or date.
- It runs Android 17 out of the box and gets seven years of OS updates.
- At the Android Dev Summit on Wednesday, Google’s smart glasses partner Xreal launched its new Xreal Aura wired smart glasses, powered by the Android XR and Qualcomm’s Snapdragon Reality Elite platforms.
- Much like it did with Android smartphones, Google is relying on an assortment of partners, including Samsung and Xreal, to bring devices powered by its Android XR platform to consumers.
- "Developers integrate with a cloud-hosted MCP server or Android MCP using the AppFunctions APIs, then use the Google Connected Console to register, test, and submit their app," according to Google.
- Developers plug in via a cloud MCP server or Android AppFunctions and pick Search, Gemini or both.
- Googlebook is a new laptop category launched by Google, featuring the deep integration of the Android ecosystem, Gemini AI, and PC experiences.
- This partnership expands Qualcomm’s PC chip market beyond Windows into the Android-based ecosystem, providing a new growth avenue amid pressures in its mobile chip business from Apple’s in-house modem development.