Home · Technology · Nov 2 archive
Google Shuts Down Malware Backdoor on Millions of Android TV Devices
· ConfirmedShare on
In Short: Google has shut down a malware backdoor on millions of Android TV devices, cutting ties with a manufacturer that intentionally deployed the malware.
Google and its partners have dismantled a botnet that infected more than 1.3 million Android TV set-top boxes, according to a report by 2-Spyware. The malware, known as x.cpe, was pre-installed on devices manufactured by Videostrong, a certified Android TV partner, and allowed for remote control and installation of additional malicious software.
9To5Google reported that Google has taken legal action against Videostrong, banning the company and its subsidiaries from selling certified Android devices or supplying software to other certified vendors. The Verge added that the backdoor was built into many device models and brands over several years, affecting a wide range of Android-based IoT devices.
Android Headlines noted that the botnet spanned more than 170 countries, with the largest concentrations in Malaysia, Brazil, Iraq, Mexico, and Taiwan. The report by 2-Spyware confirmed that about 500,000 compromised devices were online at the time, primarily in Malaysia, Mexico, and Brazil.
The Verge and 9To5Google both reported that the backdoor allowed for ad fraud, data exfiltration, and unauthorized network traffic routing. 9To5Google emphasized that Google admitted to a failure in its certification process, allowing these devices to be sold as safe.
The Hacker News reported that the backdoor is still present on the devices, and owners cannot remove it themselves. Plume found that Videostrong supplies both the firmware for these devices and tools to manage them remotely.
CyberScoop quoted Charley Snyder, head of disruption operations at GTIG, who said the XCPE operators constantly evolved their configurations to evade Google’s pre and post-launch detections. Google’s report stated that shutting down the affiliates’ control domains also locks the operators out of a further 10 million or more infected gadgets.
Despite the significant breach of trust, Google claims that the discovery of this series of actions has led to security improvements for the Android TV ecosystem. The company has now cut ties with Videostrong and is working to prevent similar incidents in the future.
The reports agree that Videostrong intentionally deployed the malware on certified Android TV devices, leading to widespread security vulnerabilities. Google has taken decisive action to dismantle the botnet and prevent further exploitation.
What this adds
The extent of the damage and the exact number of affected devices remain unclear, with different sources providing varying figures.
What's confirmed
- "a device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust."
- Google has taken legal action to block the domains and servers that “Videostrong” was using to control the XCPE botnet and malware modules and banned the company and its subsidiaries from selling certified Android devices going forward, or selling software to any other certified vendors.
- According to Google, these modules were committing ad-fraud and enrolling infected devices into “residential proxy networks,” while also loading additional malware onto compromised devices.
What's still developing
- Its trail began with a MECOOL KM9PRO Max box bought in late 2025 that already carried the malware when it arrived. [1] [4] The main component goes by x.cpe or com.oemservice and runs with Android system privileges, which is the highest everyday level on the device. [1] [4] It keeps a standing connection to a control server and can quietly install apps, run commands, take screenshots, type keystrokes and collect account details, app lists and logs. [1] [4] It can also switch off Google Play Protect, the built-in app checker. [1] [2] The money came from modules supplied by paying affiliates.
- It was part of the firmware when the boxes were manufactured. [1] [2] Synthient found an open web directory holding the backdoors and a PDF by Videostrong's research director, and several company email addresses signed the malicious files. [1] Google also said the maker hid its code to get past certification tests, loading it only after the first start-up. [3] Google was blunt.
- What’s more, Google says that by knowingly infecting devices that customers would then purchase, it was intentionally opening them up to a wide variety of malicious activity that included potential data-exfiltration and routing malicious network traffic through the devices.
- While the existence of this activity on devices that millions of people have purchased is a huge breach of trust, Google says, the company confirms that there is a positive result from discovering this series of actions.
- Google has reportedly shut down operations and cut ties with one of its Google TV /Android TV partners over inserting a backdoor that opened the path for potential botnet activity, and has since offered up an official blog post about the goings on and Google’s steps moving forward.
- Videostrong has since been banned from making more Android TV boxes with pre-loaded Google apps and services.
- The company said the dismantling of XCPE “seriously impacted over a dozen malicious actors,” yet it warned that the underlying market for backdoors, ad fraud and residential proxy networks are resilient and operating as an interconnected supply chain.
- "vendor action, platform protection or replacement of the device."
- It bought a MECOOL KM9PRO Max and found the backdoor preinstalled.