Google Caught an Android Partner Turning 1.3 Million Devices Into a Botnet

Google has cut off an Android device manufacturer after discovering the company had secretly rigged more than a million of its own products with a backdoor, turning them into a botnet that criminal groups paid to use.

The manufacturer is Videostrong Technology Co., based in Shenzhen, China. According to Google, Videostrong built the backdoor directly into roughly 1.3 million devices, most of them Android TV set-top boxes, and has now been banned from making or selling certified Android devices or supplying software for them.

What makes this different from a typical malware infection is the source. This wasn't a third party exploiting a flaw in Videostrong's hardware. Google says the company that manufactured the devices built the backdoor in on purpose, then ran it as a business.

The mechanism, as Google describes it, worked like this: devices booted up for the first time, and using what Google calls "obfuscation techniques," the backdoor would quietly install itself. From there, Videostrong didn't just use the compromised devices for its own purposes. It sold access to them to other criminal groups, who loaded their own malware onto the infected hardware. Google says Videostrong "monetized the backdoor by selling access to criminal affiliates and loading those affiliates' malware modules onto infected devices."

Those affiliate modules did a few different kinds of damage. Some ran ad fraud schemes. Others silently enrolled devices into residential proxy networks, which let someone else route internet traffic through an unsuspecting owner's home connection, often to mask the origin of other malicious activity. Still others used the backdoor as a launchpad to install additional malware. Google refers to the infected hardware as "XCPE-compromised devices" in its own breakdown of the operation.

Google says the backdoor and botnet were, in its words, "intentionally developed, deployed, and operated for financial gain." That's a notably direct accusation for Google to level at a hardware partner, and it underscores that this wasn't sloppy security practice but a deliberate scheme built around selling access to compromised devices.

The scope goes beyond set-top boxes, too. Google says the malware turned up "built directly into many different device models and brands over multiple years," and that it spread into other Android-based IoT devices, including telehealth equipment, karaoke machines, and digital signage displays. In other words, the same backdoor logic that Google found in streaming boxes also made its way into devices used in healthcare settings and public displays, expanding the real-world stakes well past home entertainment.

Google says it has since dismantled the backdoor and disrupted the command-and-control domains that the criminal affiliates used to operate their malware modules on infected devices. But the company's own assessment suggests the damage radiates further than the 1.3 million devices tied directly to Videostrong. Because those affiliate groups distribute their malware through multiple channels beyond this one backdoor, Google estimates that shutting down their C2 domains will cut off access to at least 10 million additional compromised devices elsewhere.

A supply-chain problem, not a software bug

The Videostrong case lands as a reminder of how much trust Google has to extend to the manufacturers that build Android devices under its certification. Google doesn't build most Android TV boxes itself. It licenses the software and brand to partners, who then design and ship the actual hardware. That arrangement works well when partners play straight, but it also means a bad actor inside the supply chain can embed something malicious before a device ever reaches a customer, no software update required.

Google says it has made changes to its review process for device manufacturers in response to this incident, though the company hasn't detailed exactly what those changes involve.

For now, the practical fallout is straightforward: Videostrong is locked out of the Android ecosystem, the backdoor it built has been shut down, and some of the criminal infrastructure riding on top of it has been disrupted. What's less clear is how many of the devices already in people's homes, telehealth clinics, or public spaces are still running hardware built by a company Google no longer trusts, and whether the next bad actor in the supply chain gets caught before reaching 1.3 million users.