The box in the corner was doing a second job for the Videostrong botnet
It sat under the television, quiet and unremarkable, doing exactly what a set-top box is supposed to do. It streamed shows. It waited for the remote. And, according to Google, it was also working for someone else — as part of the Videostrong botnet.
Google says that Shenzhen-based Videostrong Technology Co., an Android manufacturing partner, secretly built a backdoor into more than 1.3 million devices and turned them into a botnet it calls XCPE. The devices were mostly Android TV set-top boxes, but Google also observed other Android-based devices in the campaign, including telehealth devices, karaoke machines and digital signage. The owners, Google says, did not know. Their boxes were committing ad fraud, routing traffic for strangers and loading further malware while they simply watched television.
That is the break-in story. The more unsettling story, and the one Google’s account actually tells, is the rental story. Google assesses with high confidence that the backdoor and botnet were intentionally developed, deployed and operated for financial gain by Videostrong, which sold access to criminal affiliates. The affiliates then loaded their own malware modules onto the infected devices. A living-room box, in this account, was not merely compromised. It was inventory, rented out to other people’s crimes.
Built in, not broken into
The distinction matters, because it changes what “infected” means here. This was not, on Google’s account, a flaw that an outsider exploited after the box reached a home. The backdoor, tracked as x.cpe and under the package name com.oemservice, was built directly into device firmware during manufacturing, ran with Android system-level privileges, and was present across many device models and brands over several years.
Google says the malware was loaded onto devices after they first booted, using obfuscation techniques to evade detection, and was supported by dedicated infrastructure with constantly evolving configurations to manage its affiliates. “We believe this campaign wasn’t an isolated rogue insider or a development oversight,” Google said, in findings reported by BleepingComputer. That sentence is doing a lot of work: it rules out, in Google’s assessment, the two most forgiving explanations, a single bad employee and an accident.
How the operation was traced is itself part of the story. Synthient, one of the partners in the takedown, traced XCPE to Videostrong after finding the malware preinstalled on a MECOOL KM9PRO Max box bought in late 2025, citing an open directory, a document signed by Videostrong’s research and development director, shared IP addresses and Videostrong email addresses used to sign backdoors. Videostrong makes Android TV boxes under its own name and for other brands, including MECOOL, according to the research.
Google’s account is, in the reporting available for this article, one-sided. The Register reported that Videostrong did not immediately respond to its inquiries, and no Videostrong response is visible in the reporting checked here. The intentionality and monetization claims therefore belong to Google, stated with high confidence by its Threat Intelligence Group, not established as independent fact. Dropping that attribution would claim more than the evidence allows.
What the tenants did with the box
Once inside, the affiliates did not all do the same thing. That is the point of a rental model: the landlord sells access, and the tenants bring their own plans.
Google says affiliate modules turned devices into residential proxy exit nodes, committed ad fraud and installed further malware. The proxy services named in the research include Linkfog, AppSalt and Honeygain, NetNut, GaGaNode and Traffmonetizer; the further malware families include Moyu, Spirit and Bird. A residential proxy routes someone else’s internet traffic through an ordinary home device, so it appears to come from a real household. Ad fraud can mean faked views and clicks that siphon money from advertisers. Neither requires the owner to do anything. The box does it in the background, on the household’s connection.
Synthient estimated approximately 500,000 compromised devices were actively online, with concentrations in Malaysia, Mexico and Brazil, while Google’s total for the botnet is more than 1.3 million devices across more than 200 countries. The two figures are different kinds of estimate — one actively online, the other a total — and the reporting checked does not establish how much of the difference comes from devices simply being offline at a given moment. Even the smaller, active figure is a city-sized fleet of living-room machines.
The takedown, and what it did not remove
In late October 2026, Google and industry partners disrupted XCPE, with Google’s Threat Intelligence Group publishing its findings on 2 November 2026. The coalition named in the reporting includes Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google used legal action against XCPE command-and-control domains and against the command infrastructure of more than a dozen affiliate malware families.
Google says it has dismantled the backdoor, cut ties with Videostrong and banned Videostrong and any future subsidiaries or affiliates from building or selling certified Android devices or supplying software to certified device makers. Google also says it modified its certification review process after Videostrong used obfuscation and loading after first boot to evade testing.
The wording matters here, because it is easy to over-read. A ban on building or selling certified devices in the future, and a change to the certification review process, do not by themselves establish that the affected devices were certified devices, or what checks applied to them. That point is unestablished in the accessible reporting, and this article keeps it as an open question rather than a conclusion. The enforcement response may be strong and sufficient, in which case this is routine supply-chain policing at unusual scale, not proof that a certification badge enabled the compromise. That counterargument deserves to be stated plainly, not buried.
There is a second, harder limit to the takedown. The backdoor has not been removed from infected devices. According to the research, it reinstalls itself from the /oem/ partition if removed, so users would need clean firmware or to disconnect the device to prevent further activity. Cutting the command-and-control domains severs the operators’ access, but the code itself remains in the box, waiting for a route back in. For an owner, that is an uncomfortable position: the headline says “disrupted,” the device in the corner still carries the backdoor.
The 10 million figure, handled with care
Google says disrupting the affiliates’ command-and-control domains would sever access to at least 10 million additional compromised devices reached through distribution channels beyond XCPE. That figure has travelled widely, and it needs a footnote every time it travels.
Those additional devices are a separate, projected population, not XCPE victims, and not all of them are Android devices. They are devices the affiliates reached through other routes, whose access Google assesses would be cut by taking down the shared affiliate infrastructure. The affiliates, in other words, had diversified beyond this one backdoor, which is precisely why a takedown aimed at their command domains could reach further than a takedown aimed only at XCPE’s own boxes.
That diversification cuts both ways for the story. It makes the disruption potentially much larger than 1.3 million devices. It also means the Videostrong backdoor may be only one entry point into a larger botnet ecosystem, and centring the set-top box alone could understate the wider affiliate infrastructure. The rental business did not depend on a single landlord.
What remains unanswered
Several questions stay open, and they are the questions that would change the story if answered. What, if anything, has Videostrong said in response to Google’s claims? What should owners of affected devices do now, beyond installing clean firmware or disconnecting the device, and is any vendor remediation planned? Were the affected devices certified, and what checks applied? What remains of the botnet after the disruption, given that the backdoor persists on devices? And how much of the projected 10-million-device severance is actually realised, rather than assessed?
Until those answers arrive, the fairest summary is also the most unsettling one. On Google’s account, a manufacturing partner did not merely leave a door open. It built the door, kept the keys, and rented the rooms behind it to criminals who used ordinary people’s televisions to commit fraud, launder traffic and spread more malware. The disruption cut the phone lines to those tenants. It did not yet evict them from the building, because in too many living rooms, the building is the box itself.
