Google Disrupts 1.3 Million-Device Android Botnet Linked to Videostrong

Google has led a major operation to disrupt a botnet involving more than 1.3 million Android devices, primarily TV set-top boxes, after taking control of the infrastructure used to manage the infected devices in late October 2026.

According to Google's investigation, the botnet was powered by a firmware-level backdoor called x.cpe, which was allegedly preinstalled by Chinese device manufacturer Videostrong across multiple device models and brands over several years. Google said it has high confidence that the company intentionally embedded the backdoor and provided access to cybercriminals.

The infected devices were used for advertising fraud and residential proxy services, allowing criminals to route internet traffic through unsuspecting users' home connections. Google also warned that the backdoor remains installed on affected devices and cannot be permanently removed by owners.

Videostrong, based in Shenzhen, China, manufactures Android TV boxes and other connected devices under its own brand and for third-party companies. Google does not believe the backdoor was introduced through an isolated insider incident or accidental software change.

Google Takes Down Botnet Infrastructure

Google used legal action to disrupt the domains and servers responsible for controlling the botnet. The operation also targeted command-and-control infrastructure associated with more than a dozen malware families distributed through the backdoor.

The takedown involved cooperation from Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

Google expects the disruption to affect criminals' access to at least 10 million additional infected devices because the malware operators also distributed their tools through other channels. However, the company warned that cybercriminals often adapt quickly by moving to replacement infrastructure when their operations are disrupted.

As part of its response, Google banned Videostrong and any future subsidiaries or affiliates from manufacturing or selling certified Android devices or supplying software to other certified device manufacturers.

How the x.cpe Backdoor Operated

Google's analysis found that x.cpe operates as a system application embedded in device firmware, giving it elevated system-level privileges.

The backdoor communicates with command-and-control (C2) servers and waits for instructions from remote operators. To silently install additional applications, it first disables app verification checks in Google Play Protect, Android's built-in security feature.

Through this access, attackers could:

• Install applications without the device owner's knowledge.
• Execute remote commands.
• Capture screenshots of device activity.
• Collect information about connected networks.
• Access device information, installed applications and system logs.
• Send keystrokes and open reverse shells for remote command execution.

Google reported observing Videostrong's operators use several of these capabilities, including capturing live screenshots, collecting account details and opening remote command-line sessions.

Devices Used for Residential Proxies and Advertising Fraud

Most malware modules distributed through the backdoor converted infected devices into residential proxies or monetized their unused internet bandwidth.

Residential proxy services allow customers to route traffic through ordinary household internet connections, making their activity appear to originate from legitimate residential IP addresses.

Other modules were designed to generate fraudulent online advertising views.

Although Android TV set-top boxes accounted for most infections, the backdoor was also discovered on telehealth devices, karaoke machines and digital signage systems.

TrendAI identified 1,472,554 infected devices across 206 models between June 3 and October 1, 2026, and stated that the actual number could be higher.

The countries with the largest numbers of identified infections included Malaysia, Brazil, Iraq, Mexico and Taiwan. The United States, Germany, the United Kingdom, Australia and Canada each accounted for approximately 26,000 to 42,000 infected devices.

How Owners Can Identify Affected Devices

Synthient published a list of 182 device model names associated with the campaign. However, the organization cautioned that a matching model name alone does not prove that a particular device is infected.

Its investigation focused on MECOOL-branded devices linked to Videostrong. Synthient purchased a MECOOL KM9PRO Max and discovered that the backdoor was already installed.

Plume also identified more than a dozen device types communicating with the botnet's control infrastructure, with most of the identified devices carrying the MECOOL brand.

The backdoor presents a serious remediation challenge because it is embedded in firmware. According to the research, removing it does not provide a permanent solution because it can reinstall itself after a device restarts.

TrendAI stated that removing the threat requires vendor action, platform-level protection or device replacement. Plume recommends a factory reset because additional malicious modules may have been installed, but its research does not establish that a reset removes x.cpe itself.

Synthient recommends that consumers permanently stop using affected devices because of the security risks.

Security Recommendations for Organizations

Organizations should treat potentially compromised consumer devices as part of their network attack surface. Researchers recommend the following measures:

• Use published indicators of compromise to identify potentially affected MECOOL and related devices.
• Disconnect and replace devices confirmed to be compromised.
• Block the command-and-control domains and IP addresses identified in the research.
• Isolate smart TVs and other unmanaged IoT devices from sensitive corporate systems.
• Keep corporate access restricted to managed and trusted devices.
• Review unmanaged devices connected to employees' home networks, particularly where remote access to corporate resources is available.

Evidence Linking Videostrong to the Operation

Google identified several connections between Videostrong and the backdoor infrastructure.

Its investigation found that x.cpe passes configuration information from C2 servers to other Videostrong applications, including the YokaTV Player streaming application. Researchers also identified a GitHub account named yf-videostrong that hosted packages associated with the botnet.

Synthient independently reported several indicators linking the company to the operation. These included a document signed by Videostrong's research and development director found in an openly accessible directory on one of the botnet's servers, as well as a Videostrong web domain sharing an IP address with the operators' control panel.

Plume's research further indicated that Videostrong supplied both device firmware and remote device management tools.

Google Identifies a Gap in Android Device Security Testing

Google requires manufacturers to complete compatibility and security testing before their devices can receive Android certification. However, the company said Videostrong concealed malicious code to bypass parts of the testing process and introduced it after the devices completed their initial boot process.

Following the discovery, Google updated its review procedures and began improving firmware inspection for certified Android TV devices.

As of November 2, 2026, Videostrong's website continued to advertise products described as Google Certified Android TV Boxes and Android TV Sticks.

Plume's investigation found that the botnet affected both Google-certified devices and devices running the Android Open Source Project (AOSP) version. Google has not disclosed how many certified devices were compromised.

The incident follows Google's July 2025 lawsuit against 25 Chinese entities over the BadBox 2.0 botnet, which involved more than 10 million uncertified Android devices.

The latest operation highlights the risks associated with preinstalled firmware backdoors and compromised connected devices, particularly when manufacturers have privileged access to the software running on consumer hardware.