Google bans Videostrong after finding backdoor in certified Android TV boxes

Google has severed its relationship with Videostrong, a manufacturer of certified Android TV boxes, after finding that the company built in a backdoor that could be sold for distributing malware. The company took legal steps to block the domains and servers that Videostrong used to run the XCPE botnet and distribute malware, and it barred Videostrong and its subsidiaries from selling certified Android devices or software to other certified vendors.

Google said the malicious software was "built directly into many different device models and brands over multiple years," backed by dedicated infrastructure and constantly changing configurations to evade detection. "We believe this campaign wasn’t an isolated rogue insider or a development oversight," the company said. As a result, Google said it has "cut ties with Videostrong and banned them from making devices with preloaded Google apps".

Synthient, in a list reported by The Hacker News, identified potentially affected devices, with a focus on the Mecool brand, which has made Android TV and Google TV boxes in the past, according to 9to5Google. Mecool is rumored to be shutting down, 9to5Google noted.

Google explained that the bad actors "employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device’s first boot". The company is updating its review process and called a manufacturer intentionally infecting users with malware "an unacceptable breach of trust".

Google said that "taking down their C2 domains will sever access to at least 10 million additional compromised devices," but 9to5Google suggested that owners may still want to consider alternate options.

Update, November 2, 2026

The Verge reported on Monday that Google now says the backdoor was built into 1.3 million devices. The malware appeared across many models and brands over multiple years; Android TV set-top boxes were the most common affected models, but other Android-based IoT hardware was also hit, including telehealth devices, karaoke machines and digital signage. Google described the operation as intentional and run for financial gain, saying Videostrong sold access to criminal affiliates and placed their malware onto infected devices. Those modules carried out ad fraud, enrolled the hardware into residential proxy networks, and installed additional malware. Google also said the devices were used without their owners' knowledge for data exfiltration and to route unauthorized network traffic.