Android TV Box Botnet: Google Cuts Off Maker After 1.3M Hijacks

More than 1.3 million streaming boxes were quietly working for someone else. That is the headline figure behind the Android TV box botnet Google moved against on November 2, when its threat intelligence team said a Chinese device maker, Videostrong Technology, built a backdoor into its own hardware and rented that access to criminals.

The numbers below come from Google and from the security firms that helped track the operation. They explain why this story matters to anyone with a cheap streaming stick or set top box plugged into the living room TV.

• 1.3 million plus: set top boxes Google says the XCPE backdoor enrolled into a botnet.
• 10 million plus: additional compromised devices Google says lost their link to attackers once it took down affiliate command servers.
• 1,472,554: infected devices counted by TrendAI between June 3 and October 1, according to The Hacker News.
• 206: device models in TrendAI's count.
• 182: model names on a list published by researchers at Synthient, with MECOOL branded boxes at the center of it.
• More than a dozen: malware families whose control domains Google targeted with legal action.
• 6: outside partners Google named, including Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

1.3 million boxes and one company behind them

Most botnets grow by tricking people into installing something bad. This one shipped from the factory. In its report on the XCPE botnet, Google said it assessed with high confidence that Videostrong, an Android device maker that also builds hardware for other brands, created and ran the backdoor for financial gain.

The company then sold access to affiliates. Those buyers used the boxes for ad fraud, for residential proxy networks that route other people's internet traffic through your home connection, and to load even more malware.

Google also admitted where its own checks fell short. Videostrong used obfuscation to slip past certification tests and pull in malicious code only after a device's first boot. That detail matters, because Videostrong's own website still advertised "Google Certified" TV boxes and sticks as of November 2, The Hacker News reported. Google's post does not say how many certified devices were caught up in it.

Why 10 million more devices dropped off at once

The bigger figure is not about Videostrong's boxes alone. Google went after the servers that criminal affiliates used to control their malware, and it says those takedowns cut off at least 10 million more infected devices. The backdoor was not limited to TVs either. Google found it on telehealth devices, karaoke machines and digital signage.

Once inside, the code ran as a preloaded system app. Uninstalling it did not help much, since it reinstalled itself from a protected folder after a reboot. It also switched off Google Play Protect checks. Google observed it taking screenshots, injecting keystrokes, running shell commands, opening reverse shells and pulling data off devices. For a refresher on how this kind of software works, see our guide on what malware is.

206 models, and the brands people actually bought

Google did not list brands or models. The security firms did. Synthient's list of 182 model names focuses on MECOOL boxes, and the firm bought a MECOOL KM9PRO Max and found the backdoor already installed. TrendAI's count of 206 models showed the most infections in Malaysia, Brazil, Iraq, Mexico and Taiwan, but these boxes are sold widely online in the US too.

Google's response has three parts beyond the server takedowns:

1. Videostrong and any future subsidiaries or affiliates are banned from building certified Android devices or supplying software to certified vendors.
2. Certified Android TV devices now get firmware integrity checks.
3. Legal action covers the domains and servers Videostrong used.

One reset may not be enough

The experts quoted by The Hacker News do not fully agree on cleanup. Synthient says to throw affected boxes away. Plume suggests a factory reset, though it did not say whether that removes the backdoor. TrendAI says a fix needs vendor action, platform protection or a new device. Given that the code lives in system storage, replacing a no name box is the safer bet.

If you own a cheap Android box, check whether its maker appears on Google's list of certified Android TV partners, keep Play Protect on, and stick to the Play Store for apps. Google also warns against any app that offers to pay you for "unused bandwidth," since that is how many residential proxy schemes recruit devices. A box on your network is only as safe as the network itself, so it is worth taking a few minutes to lock down your home Wi-Fi router.

Android phones have had their own close calls this month, including the SMS of death bug. If you think a seller misled you about a box, you can report it as a scam. More device coverage lives in our gadgets section.