TL;DR: Google says it just dismantled a botnet built from more than 1.3 million Android TV streaming boxes, and the twist is that the manufacturer allegedly built the malware on purpose and sold access to criminals, rather than getting hacked. Google banned the company, Videostrong, from making Android devices ever again.
Google announced Tuesday that it led a takedown of a malware network called XCPE, built from more than 1.3 million Android TV set-top boxes, working alongside Japan’s National Police Agency and security firms including Lumen, HUMAN Security, Plume, Synthient, and TrendAI.
Most botnet stories follow a familiar script: a manufacturer gets hacked, malware slips into the supply chain without anyone at the company knowing, and everyone scrambles to patch it after the fact. That’s actually what happened last month to Doogee and Cubot, two Chinese phone makers whose devices shipped with malware Bitdefender found had been quietly inserted somewhere upstream. This one is different, and worse.
According to Google, the manufacturer behind the infected boxes, a company called Videostrong, knew exactly what it was shipping. Google’s statement doesn’t leave much room for interpretation.
“A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users,” Google said.
The XCPE backdoor did three things at once. It generated ad fraud revenue. It acted as a dropper, pulling in more than a dozen additional malware families through the same backdoor channel. And it enrolled every infected box into a residential proxy network, the kind of infrastructure criminals rent out to disguise their real location while scraping websites, stuffing stolen credentials into login forms, or launching DDoS attacks that look like they’re coming from ordinary households rather than a criminal operation.
That last part is the one worth sitting with. If you bought a cheap Android streaming box in the last couple of years, its internet connection might have been quietly rented out to someone running a credential-stuffing operation against a bank, and you’d have had no way to know it was happening. Google hasn’t said how many countries the affected devices were sold in, how much money Videostrong made selling access, or who was actually buying it.
Google’s explanation of how Videostrong got the malware past its testing is almost as unsettling as the scheme itself. The company says Videostrong “employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device’s first boot,” meaning the box would pass Android’s certification checks clean, then quietly activate its payload once it reached a real customer’s living room. Google has since tightened its firmware integrity checks and changed its device review process in response, and it’s permanently banning Videostrong, along with any future subsidiaries or affiliates, from building or selling Android devices or supplying software to other certified vendors.
This isn’t an isolated incident in the smart TV world this year. Samsung and LG both recently promised to strip “botnet” apps out of their own smart TV app stores after researchers found that more than 40% of webOS apps carried residential proxy code, turning ordinary television sets into scraping infrastructure without owners ever noticing a thing. Android car systems have reportedly been hijacked for similar hidden proxy networks. The pattern across all of these stories is the same: smart devices that look like simple hardware are increasingly valuable as anonymous internet infrastructure, and the business model for abusing that is maturing fast.
What makes the Videostrong case the most serious of the bunch is motive. A compromised supply chain is a security failure a company can at least claim to be a victim of. A manufacturer building the malware itself and selling access to it is a business model, and Google’s choice to ban the company outright, rather than just patch around the problem, reflects how it’s treating that distinction.
There isn’t much a consumer can do retroactively if they already own one of these boxes beyond replacing it, since Google’s takedown targets the command-and-control infrastructure rather than removing malware already running on individual devices. The more useful takeaway is about buying habits going forward: cheap, unbranded Android streaming boxes bought outside major retail channels are exactly the kind of device where this sort of thing slips through, because they rarely get the scrutiny that a Roku, an Apple TV, or a name-brand Android TV set gets. If a streaming box seems unusually cheap for its specs, that’s not always a bargain. Sometimes it’s a sign the business model isn’t streaming at all.
Google’s enforcement move here is also a window into a broader fight happening inside the Android ecosystem right now. Google has spent much of this year tightening certification requirements across its device partners, and this takedown, paired with the company’s other recent moves around content controls, fits a pattern of Google using its market position more aggressively than it has in years past, whether the target is a rogue hardware vendor or the rules governing how its own AI products use the web.
It’s worth asking why this kind of scheme works at all, and the answer is mostly about incentives that haven’t caught up with how cheap it’s become to manufacture internet-connected hardware. Building and certifying an Android TV box is a low-margin business. Renting out a million-plus devices’ worth of residential IP addresses to criminal buyers, by contrast, is extremely profitable, and nothing about the certification process Google ran until now was built to catch a manufacturer that wanted to do both at once. Google’s fix, tighter firmware checks and a permanent ban, addresses this specific company. It doesn’t obviously stop the next Videostrong from trying the same obfuscation trick with slightly different techniques.
This also raises an uncomfortable question for retailers and marketplaces that sold these boxes without ever auditing what was actually running on them. Google’s statement focuses entirely on its own certification process and its own response, and says nothing about whether platforms that distributed Videostrong’s hardware bear any responsibility for passing along a device built, according to Google’s own account, specifically to defraud the people buying it.
The bottom line
A device manufacturer didn’t get hacked here. It built the hack, shipped it on purpose, and sold access to cybercriminals for however long it took Google and a half-dozen security firms to catch it. The ban is the right call, but it doesn’t undo whatever damage 1.3 million compromised devices already caused while this ran undetected. If your streaming box came from a brand you’ve never heard of and cost suspiciously little, it might be worth checking what it’s actually been doing on your network.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
