Google says Videostrong exploited a certification gap to infect TV boxes

Google accuses a maker of certified Android TV devices of loading malware after first boot. More than 1.3 million boxes joined the botnet, Google says. That does not show how many certified devices were repaired.

Google has accused a maker of certified Android TV devices of deliberately building a backdoor. The alleged operator is a manufacturer with control of device software. Google does not attribute it to an outside group exploiting boxes after sale.

In a post dated 2 November, Google's Threat Intelligence Group says XCPE "enrolled more than 1.3 million set-top boxes into a botnet." The takedown occurred the week before. That counts infected boxes, not how many were certified or later secured.

What Google says happened

Google assesses "with high confidence" that Videostrong Technology Co., an Android device maker, "intentionally developed, deployed, and operated" the backdoor for financial gain. It says the campaign "wasn't an isolated rogue insider or a development oversight." This is Google's attribution, with no earnings figure.

The reported business was selling access. Affiliates loaded modules that ran ad fraud, enrolled devices in residential proxy networks and installed further malware. A residential proxy rents out a home internet address so someone else's traffic appears to come from that household.

Google estimates that shutting affiliate command domains will cut off at least 10 million more compromised devices, because affiliates also spread modules through other channels. That is a prospective estimate, not a measured cleanup of the 1.3 million boxes. Synthient's founder, Ben Brundage, told KrebsOnSecurity the 1.3 million figure is "highly conservative."

How it passed the tests

Google says Videostrong "employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device's first boot." That shows evasion of Google's tests, not that the malicious code itself was examined and approved. Google does not describe the full certification sequence.

The main component ran with system privileges and reinstalled itself from a separate firmware partition after removal and reboot. It switched off Google Play Protect, Google's built in Android malware scanner. Operators could capture screens, inject keystrokes and run commands.

TechTimes reports that Plume first noticed unrelated boxes contacting an unfamiliar server. Synthient linked it to Videostrong through a GitHub account, a shared server address and a document signed by its research director. Videostrong's website still advertised Google Certified products on 2 November, a marketing claim rather than a count of certified infected devices.

Google found infected telehealth devices, karaoke machines and digital signage, although the "overwhelming majority" were Android TV boxes. A Synthient report on a MECOOL box sold by China's Skyworth Technology found the same Videostrong code.

Google banned Videostrong and any future subsidiaries or affiliates from building certified devices or supplying software to certified vendors. It also tightened firmware integrity checks for certified Android TV devices. The account gives no cleanup count for existing boxes.

How botnets have recovered after takedowns

In July 2025 Google sued the anonymous operators of BadBox 2.0 in New York, citing more than 10 million uncertified devices running open source Android. Here Google accuses a manufacturer that submitted devices to certification. The size of XCPE's certified cohort is not specified, so the two device counts cannot yield a comparative infection rate.

Google's January IPIDEA action found over 550 threat groups using its exit nodes in one week. Its July NetNut action described at least 2 million devices.

Following IPIDEA, Google observed proxy operators "buying capacity from their competitors, effectively becoming a reseller." That offers a mechanism for substitution, though repeated enforcement alone does not prove a takedown failed.

Censys found only 9% of reported Aisuru control addresses active after the March 2026 takedown. Within four months known infrastructure had more than doubled. Censys calls its data directional.

Nokia reports a similar pattern for Kimwolf. It went quiet but split into more than 20 rivals, and daily active DDoS endpoints grew about eightfold in a year.

HUMAN's chief information security officer, Gavin Reid, said group action "interrupts the infrastructure needed for monetisation, raising the cost of operating these networks." Google warns that the "underlying illicit market is resilient".

Certification failed to catch persistent code

CTOL's interpretation is that the first failure was in the assurance attached to certification. Google describes loading after first boot through a gap in its tests. Compromised boxes stay dangerous because privileged code can persist.

Google's responses address different risks. Disrupting affiliate domains targets command access and monetisation. The ban targets future certified supply chains, and tighter checks target detection. None shows that deployed firmware was removed. A useful measure would separate disrupted access, blocked code and devices actually secured.

Google tells retailers and distributors to "require independent security audits" from design manufacturers and to "swiftly delist" implicated ones. It also asks proxy providers for "transparent, auditable proof of user consent," which sets a standard without showing that any named provider lacks it.

Regulation also affects purchasing. The EU Cyber Resilience Act's reporting duties began on 11 September 2026, and its main product rules apply from 11 December 2027. The UK's product security regime has applied since 29 April 2024 and covers distributors, including retailers. Nothing here shows a particular rule would have caught XCPE.

The financial mechanism is conditional. If a manufacturer is paid for access after selling a compromised box, software control creates an extra revenue opportunity. That is CTOL's inference. No evidence shows every Videostrong device earned money.

There is an equally important counterargument: Google banned the supplier, disrupted affiliate domains and tightened checks. Comparable networks cannot say whether that keeps XCPE suppressed.

What could happen next

The following scenarios are ranked by likelihood, without numerical probabilities.

Most likely, original XCPE infrastructure stays impaired, but former affiliates find replacement capacity or a successor loader. Other distribution channels and proxy resale favour this; the ban and tighter checks weigh against it. A dated report linking a successor loader to former XCPE affiliates by 3 February 2027 would support it.

Retailers could also plausibly delist Videostrong or MECOOL boxes and demand audits. No retailer commitment is documented. Dated delisting notices by 3 February 2027 would support it.

Less likely, new integrity checks catch another post boot loader before shipment. A public report of blocked firmware by 3 February 2027 would support it.

What would prove CTOL's prediction wrong?

With moderate confidence, CTOL expects that Google, HUMAN, Plume or Synthient will publish a technical report by 28 February 2027. It will link a successor loader or replacement access channel to former XCPE affiliates. Multiple distribution routes and observed proxy resale support the mechanism.

A qualifying report by the deadline confirms the prediction. If none appears, the prediction is false, though silence does not prove the operation ended. An unrelated botnet does not count.

The decisive disclosure is how many compromised boxes were actually certified and how many existing devices were secured. Removing Videostrong's Google Certified claims from its website would change a marketing signal, not repair firmware.