Google shuts down a botnet hidden inside 1.3 million Android TV boxes, and blames the maker

The small box under your television streams films and football. It may also have been working for someone else. Google says more than 1.3 million Android TV boxes carried a hidden backdoor that let criminals use their owners’ home internet without anyone knowing.

This is not the usual story of Android TV box malware slipping in through a bad app. Google’s Threat Intelligence Group says, “with high confidence”, that the backdoor was built in on purpose by the company that made the boxes: Videostrong Technology Co., a Chinese device maker. It says the scheme, run for profit, was “not an isolated rogue insider or a development oversight”.

How Videostrong’s boxes became an Android TV box botnet

A botnet is a large group of hacked devices that someone controls from a distance. Google names this one XCPE, after a hidden app in the boxes’ built-in software (firmware). According to Google, the app ran with full system rights, put itself back after a restart if removed, and switched off Google Play Protect, Android’s own app scanner.

Videostrong then sold access to criminal “affiliates”, Google says. Their add-ons did three things: ad fraud, turning boxes into “residential proxies” (so other people’s internet traffic looked as if it came from your home), and loading more malware.

Google says the backdoor has been active since at least late 2024. Most infected devices were TV boxes, but Google also found it in telehealth devices, karaoke machines and digital signs. Its map shows infections on every inhabited continent.

Last week, Google says, it took legal action with partners to take down Videostrong’s control servers, plus those of more than a dozen malware families loaded through the backdoor. Google names its partners as Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google expects the affiliate takedowns to cut access to at least 10 million more infected devices that were spread in other ways too.

A certified box that slipped past Google’s own checks

Google has cut ties with Videostrong. It has also banned the company, and any future subsidiaries, from making certified Android devices or supplying software to certified makers. “A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust,” Google wrote.

The harder part is that these boxes were sold as certified. Google says Videostrong hid its code to “exploit a gap in our tests”, loading the bad parts only after the first start-up. Google says it has now changed its reviews and firmware checks for certified Android TV devices. 9to5Google says Google partly admits a failing here. It is fair to ask how the gap stayed open for about two years.

How to check the TV box in your home

There is no official removal tool, and Google has not published a full list of models. Security firm Synthient’s list of possibly affected devices focuses on the Mecool brand, which also appears in Google’s technical notes. If you own a Mecool box, treat it with care.

9to5Google says the takedown should leave infected boxes safe to use, but owners may want to replace them. Because the backdoor lives in the firmware and reinstalls itself, it is unclear whether a factory reset or a scan removes it; that is our reading, not a Google statement.

Google’s own advice for everyone:

• Buy set-top boxes and other connected devices only from known makers. Google keeps a list of Android TV partners on its website.
• Be wary of any app that pays you for “unused bandwidth” or for “sharing your internet”.
• Install apps only from trusted app stores.
• Check what VPN and proxy apps are allowed to do.
• Keep Google Play Protect switched on.

This backdoor switched Play Protect off, so check now and then that it is still on.

Why the fix matters more than the takedown

The good news is real. Google worked with Japan’s police and several security firms, named the company behind the scheme, and admitted a gap in its own testing.

But a takedown is not a cure for Android TV box malware. Google itself describes this criminal market as “resilient”, with operators who move fast to new tools. The boxes are still in homes, and Videostrong has not commented publicly, as far as reports show. On balance, the lasting result will depend on whether the tighter firmware checks hold, and whether online marketplaces stop selling boxes from makers that broke the rules.

Our reports on spyware hidden in online ads and the Northflank hack and stolen AI keys show the same lesson: trust in a platform has to be earned again and again.

The cheapest box on a shopping site is rarely the cheapest in the end. Before you plug in your next one, check who made it.