The Malware Came From the Factory: How Google Tore Down a 1.3 Million-Device TV Box Botnet
Google says a Chinese TV box maker built a backdoor into its own devices and rented them to criminals for proxy traffic and ad fraud. The takedown cuts off more than 1.3 million boxes, but the malware stays on them. What it means for the cheap gadgets plugged into business networks.
Most botnets are built by breaking into devices. The one Google and its partners dismantled this week was, according to Google, built in. Its threat intelligence group says a Chinese manufacturer, Videostrong Technology Co., loaded a persistent backdoor into Android TV boxes it produced and then sold access to them.
This account draws on KrebsOnSecurity’s write-up of the takedown and BleepingComputer’s technical summary of Google’s report.
A backdoor with paying customers
Google calls the botnet XCPE, after one of its core components. It counts more than 1.3 million infected set-top boxes. The backdoor runs with Android system privileges and, after start-up, checks in with a command server that can silently install apps, switch off Google Play Protect, run shell commands, capture screenshots, inject keystrokes and collect account and device details.
Google says Videostrong turned that access into a business. Criminal affiliates paid to load their own modules onto the boxes. Some turned the owner’s internet connection into a “residential proxy” that strangers could rent to disguise their traffic, a service often used for account takeovers, ad fraud and mass scraping. Others generated fake ad clicks or installed still more backdoors. The report names several proxy providers whose software showed up on infected devices.
How investigators followed the trail
The security firm Synthient found the malware preinstalled on a MECOOL-brand TV box bought in late 2025. An exposed directory on the attackers’ file server held backdoor files, a document linked to Videostrong’s research and development director, and signatures made with company email addresses. Videostrong’s own domain pointed to the same IP address as part of the command infrastructure. Google says the evidence shows a deliberate operation over several years, not a rogue employee or an accident.
The takedown, and its limits
Working with Japan’s National Police Agency and companies including Lumen, HUMAN Security, Plume, Synthient and TrendAI, Google took down command servers used by more than a dozen related malware families. It estimates that this also cuts off at least 10 million other compromised devices, among them karaoke machines, telehealth hardware and digital signage, not all of which run Android. Google also ended its relationship with Videostrong, revoked its license for certified Android TV devices and says it has closed the certification gap the company used to load code after first boot. Synthient’s founder called the 1.3 million figure “highly conservative.”
There is a catch. The malware is still on the devices, and if removed it reinstalls itself from a protected partition. Owners need clean firmware or need to take the device off the internet.
What this means for your company
Cheap streaming boxes, digital signs, lobby TVs and smart gadgets often get plugged into the office network because it is easy. When the threat ships from the factory, no amount of careful clicking helps. Buy connected devices from established brands with a security track record, keep anything that is not a business computer on a separate guest or IoT network, and remove devices nobody owns or needs. If you spot unexpected outbound traffic from a TV or signage player, take it seriously.
Wondering what consumer gadgets are sitting on your business network, and whether they are walled off from your computers? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
