Google Says 1.3 Million Android TV Boxes Ran a Criminal Botnet

Google says one of its Android manufacturing partners secretly built a backdoor into 1.3 million devices and operated them as a botnet. The company states it has dismantled the backdoor and cut ties with the manufacturer. The firm in question is Videostrong Technology Co., based in Shenzhen, China. Google has banned it from building or selling certified Android devices and from supplying software for them.

Google says Videostrong hijacked its devices with malware "intentionally." The infected devices ran without owners' knowledge. Google lists the malicious activity as ad fraud, data exfiltration, and routing unauthorized network traffic.

What exactly did Videostrong do?

Google's allegations go well beyond sloppy engineering. The company claims the "backdoor and botnet were intentionally developed, deployed, and operated for financial gain."

The core accusation is a commercial one. Google said:

Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates' malware modules onto infected devices. These secondary modules were conducting ad-fraud; silently enrolling infected devices into residential proxy networks; and loading additional malware onto XCPE-compromised devices.

That last claim deserves attention. Google also says it disrupted the command and control (C2) domains that operated those affiliate modules. The company then quantified the wider damage. Its full statement continued:

Because these affiliates each have diversified distribution channels for their modules beyond XCPE, we assess that taking down their C2 domains will sever access to at least 10 million additional compromised devices.

Ten million is Google's own assessment, not a verified count. The company says "at least," which signals a floor rather than a ceiling. No independent verification of either figure exists in the source material. Google does not say when the operation began or how long the botnet ran undetected.

Which devices were affected?

The scope was broad. Google says the malware was "built directly into many different device models and brands over multiple years." That phrasing matters. This was not a single bad product run or a single compromised firmware update.

Most affected devices were Android TV set-top boxes. But the botnet also reached other Android-based IoT hardware. Google names three categories:

• Telehealth devices
• Karaoke machines
• Digital signage devices

The telehealth category is the most troubling. Devices used for medical data were silently enrolled in residential proxy networks and used for ad fraud. Google does not say how many telehealth units were infected, nor what data may have been exfiltrated from them.

How was the malware delivered?

The delivery method was simple and effective. Google says Videostrong used "obfuscation techniques" to load the malware onto users' devices after they booted up the hardware for the first time.

That timing is a deliberate choice. First boot happens before most users apply scrutiny. A device that works normally after setup raises no alarms. The malware was embedded at the manufacturing stage and activated post-boot, which places responsibility squarely inside the supply chain rather than with end users.

What changes at Google?

Google says it has made changes to its review process for device manufacturers after this incident. The company does not describe those changes. It does not say whether the new process would have caught this backdoor. It does not say how many other partners face similar review.

The ban on Videostrong is concrete. The firm can no longer build or sell certified Android devices, and it can no longer supply software for them. Google does not say whether it will pursue legal action, whether law enforcement is involved, or whether Videostrong customers will receive remediation.

What is the wider exposure?

The C2 takedown claim carries the largest number in this story. Google assesses that severing those domains will cut off access to at least 10 million additional compromised devices beyond the 1.3 million Videostrong units. That figure implies the affiliate ecosystem reached roughly eight times the size of the original botnet.

Some caveats follow. Google says the affiliates have "diversified distribution channels" beyond the XCPE malware. Taking down C2 domains severs access, but it does not remove the malware from the devices. Google does not say whether the compromised hardware can be cleaned or whether owners will be notified.

The reputational question is also unanswered. Android certification exists to signal trust. A certified partner shipping backdooled hardware over multiple years, across many brands, undermines that promise. Google acknowledges this indirectly by revising its manufacturer review process, but it offers no details on what failed.

For buyers of low-cost Android TV hardware, the commercial lesson is plain. A certified logo on the box did not prevent a manufacturer from monetizing its customers' devices as network real estate. Google says it has now dismantled that business, and its C2 takedown may disrupt affiliate operations across at least 10 million more devices, but the company has not said what its new review process will actually catch.