Google has severed ties with a device manufacturer that built a malicious backdoor into certified Android TV boxes, according to 9to5Google. The tech giant revealed the takedown of this campaign on November 3, 2026, which involved blocking domains linked to the XCPE botnet and updating safety reviews.
Key takeaways
- Google cut ties with a manufacturer named Videostrong over a preloaded malware backdoor.
- Legal action blocked domains and servers controlling the XCPE botnet.
- Synthient compiled a list of potentially affected devices, focusing on the Mecool brand.
- Google is updating its review process to close security gaps exploited during device setup.
What happened with the infected Android TV boxes?
9to5Google reports that an Android TV device maker named Videostrong built a backdoor directly into certified hardware to sell access and distribute malware. Google stated that the malicious software operated across multiple years and brands using dedicated infrastructure to evade detection. Bad actors used obfuscation techniques to slip past testing routines and load code after the hardware booted up for the first time.
Because these units carried certification, consumers trusted them as safe products. Google admitted this situation exposed a gap in their testing procedures. In response, the company banned Videostrong and its subsidiaries from manufacturing certified hardware or selling software to other verified vendors.
How are users protected from the malware backdoor?
Google took legal action to shut down the domains and servers that managed the XCPE botnet and malware modules. This intervention severs access to at least 10 million compromised units. Synthient published a list of potentially affected hardware, highlighting the Mecool brand, which faces rumors of shutting down entirely.
What it means for device owners next
Affected consumers may still want to consider alternate options despite the server shutdowns. Google adjusted its review process to prevent similar breaches, emphasizing that a manufacturer intentionally infecting users represents an unacceptable breach of trust. Owners of impacted Android TV boxes should stay alert as ecosystem security upgrades roll out.
Frequently asked questions
According to 9to5Google, a company named Videostrong manufactured the certified hardware that included the built-in malware backdoor.
Google cut ties with Videostrong, banned the company and its subsidiaries from selling certified devices or software to vendors, and took legal action to block their control servers.
Bad actors employed obfuscation techniques to exploit a gap in Google tests, loading the malicious code only after the device completed its first boot.
Synthient compiled a list of potentially affected devices with a primary focus on the Mecool brand, which has made well-known streaming boxes in the past.
Google stated that taking down the command and control domains severed access to at least 10 million additional compromised devices.
Based on reporting by 9to5Google. Read the original article
