Google's discovery of a backdoor in more than 1.3 million devices, including Android TV-certified set-top boxes, has raised questions about the security checks used to certify connected consumer devices. The malware, allegedly developed and embedded by Chinese device manufacturer Videostrong Technology, allowed attackers to access infected devices, steal information and use their internet connections without the owners' knowledge.
The incident is significant because some of the affected devices carried Google's Android certification, which is meant to indicate that they meet the company's compatibility and security requirements. Google has acknowledged that Videostrong exploited a gap in its testing process to install malicious code after a device's first boot. The company has since cut ties with the manufacturer and taken steps to disrupt the botnet.
The case raises a wider concern for consumers who buy Android TV boxes and other connected devices. Even when a device carries a recognised software certification, its firmware and the manufacturer's practices can introduce security risks that are difficult for users to identify.
What happened
According to Google Threat Intelligence Group, the backdoor, identified as XCPE or x.cpe, was built into multiple device models and brands manufactured by Videostrong over several years. Google said it had high confidence that the manufacturer deliberately developed and operated the backdoor to generate revenue by selling access to infected devices to criminal affiliates.
A botnet is a network of internet-connected devices that have been infected with malicious software and can be controlled remotely by an operator. The devices can include computers, smartphones, routers and smart home products. Once infected, they can carry out instructions without the owner's knowledge.
In this case, more than 1.3 million set-top boxes were enrolled into the XCPE botnet. According to Google Threat Intelligence Group, Videostrong monetised access to infected devices by allowing criminal affiliates to install additional malware modules for activities such as advertising fraud and residential proxy services.
The operation was not limited to Android TV boxes. Google's investigation also identified the backdoor on telehealth devices, karaoke machines, and digital signage products.
Google said it worked with Japan's National Police Agency and cybersecurity companies, including Lumen, HUMAN Security, Plume, Synthient and TrendAI, to disrupt the operation. The company took legal action to shut down the domains and servers used to control the infected devices and distribute malware.
It also took down the command-and-control domains used by more than a dozen malware families distributed through the backdoor. Google estimates that this action could cut off access to at least 10 million additional compromised devices, although these devices were not necessarily all infected through XCPE.
What could the malware do on an infected device
The XCPE backdoor gave its operators access to the device at the system level. In simple terms, this meant the malicious software had privileges that allowed it to perform actions beyond what an ordinary application could do.
A regular application generally operates within a set of permissions and restrictions. A system-level process has much broader access to the operating system and its functions.
This allowed the operators to install applications without the owner's knowledge, execute commands remotely, capture screenshots and collect information stored on the device. Google's investigation found evidence of operators capturing live screenshots, injecting keystrokes and extracting account information, device details, installed application lists and system logs.
The malware could also disable Google Play Protect, Android's built-in security feature that checks applications for potentially harmful behaviour. This made it easier to install additional malicious software without triggering the usual checks.
Another feature that made the backdoor difficult to remove was its presence in the device's firmware.
Firmware is the software built into a device that controls its basic hardware functions and helps the operating system communicate with its components. Unlike an application that can be uninstalled through the settings menu, firmware is part of the device's underlying software.
Google found that XCPE could reinstall itself after a device restarted, even if a user had removed its visible application package. This meant that conventional methods of removing unwanted applications were not enough to eliminate the infection.
How were infected devices used for advertising fraud and proxy networks
One of the main ways the operators monetised the infected devices was by turning them into residential proxy nodes.
A residential proxy is an internet connection that routes another person's online traffic through a regular household internet connection. Websites and online services see the traffic as coming from the household's internet address rather than the actual person or organisation using the proxy.
Such services can have legitimate uses, including testing websites across different locations. However, they can also be used to hide the identity and location of cybercriminals, evade restrictions and carry out fraudulent activities.
In the XCPE operation, infected TV boxes were enrolled into proxy networks without the owners' consent. Criminal affiliates could then use the household's internet connection to route their traffic.
This creates a risk for users because suspicious online activity may appear to originate from their internet connection. It can also consume network bandwidth and affect internet performance.
The malware was also used for advertising fraud. In this case, infected devices could simulate advertisement views and interactions without displaying advertisements to the user. Advertisers and advertising networks may then be charged for impressions or activity that never involved a genuine viewer.
The operators could also install further malware modules, giving other criminal groups access to the same devices for different activities.
How did the backdoor bypass Google's Android certification checks
This is one of the more significant aspects of the incident.
Google requires manufacturers to undergo compatibility and security testing before their devices can be certified to run Android with Google apps and services. The process is intended to ensure that devices meet the requirements for running the Android ecosystem, including applications such as Google Play Store and YouTube.
According to Google Threat Intelligence Group, Videostrong used obfuscation techniques to conceal the malicious code during initial security checks and activate it only after a device's first boot.
Obfuscation refers to methods used to hide or disguise software code, making it harder for security tools and researchers to understand what it does.
This is important because a device can pass checks conducted at one stage of manufacturing but have its software altered later. If the testing process does not account for such changes, malicious code could remain undetected even when the device has passed certification.
Google has acknowledged this gap and said it is changing its review process to improve checks on the integrity of firmware in certified Android TV devices.
The company has also banned Videostrong and its future subsidiaries and affiliates from manufacturing certified Android devices or supplying software to other certified manufacturers.
However, Google has not disclosed how many of the more than 1.3 million infected devices were Google-certified. The investigation also identified affected devices running the Android Open Source Project (AOSP), the open-source version of Android that manufacturers can use without Google's certification or preloaded Google services.
Does Android certification guarantee that a device is secure
Android certification is an important indicator of compatibility and compliance with Google's requirements, but it should not be treated as a guarantee that a device will remain free of security threats throughout its lifetime.
Certification involves testing a device against a set of requirements. It does not mean that every component, application or subsequent software update will remain secure indefinitely.
The XCPE incident also highlights the role of original equipment manufacturers (OEMs) and original design manufacturers (ODMs) in the Android device supply chain.
An OEM typically sells products under its own brand, while an ODM designs and manufactures devices that can be sold by other companies under their respective brands. A single manufacturer can therefore supply hardware and software to several brands.
This makes it difficult for consumers to establish who is responsible for the software running on a device. A set-top box may carry the name of one brand, while its hardware, firmware and software have been developed or supplied by another company.
If the manufacturer responsible for the firmware embeds malicious code, the brand selling the finished product may not have complete visibility into what is running on it.
How can users check if their devices are affected
Google has disrupted the XCPE botnet's infrastructure and cut off the servers used to control infected devices. However, taking down these servers does not necessarily remove the backdoor from the devices themselves.
Owners of potentially affected TV boxes should first check the manufacturer and model of their device. Cybersecurity firm Synthient has published a list of 182 device model names associated with the campaign. However, the presence of a model on the list does not, by itself, confirm that an individual device is infected.
Google recommends buying connected devices from reputable manufacturers and referring to its official Android TV partner list.
Additionally, Google has released a global distribution map that shows that the XCPE botnet had an international footprint, with affected devices reported across North America, Russia, Brazil, Australia and parts of Europe and Southeast Asia. India does not appear among the countries highlighted. The map also suggests that the botnet's spread followed Videostrong's device distribution channels, rather than being concentrated in a single market.
This is not the first instance of pre-installed malware
The Videostrong incident is not the first time cybersecurity researchers have found malware embedded in Android devices. In 2025, Google's investigation into the BADBOX 2.0 botnet identified more than 10 million compromised devices, including smart TVs, streaming devices and projectors. The infected devices were used for advertising fraud and residential proxy services. In 2024, security researchers also found the Vo1d backdoor on nearly 1.3 million Android TV boxes across 197 countries. The malware was embedded in system storage and allowed attackers to install additional software remotely.
While these incidents involved different malware campaigns and device categories, they point to recurring weaknesses in the security of connected consumer devices. The Videostrong case, however, raises questions about the effectiveness of Google's certification process, the oversight of third-party manufacturers and whether existing security checks can detect malicious code introduced during manufacturing.
 "Explained: How a backdoor in Android TV devices exposed 1.3 million users")
Connect with us on WhatsApp