Google shuts down malware backdoor on Android TV boxes
Google has severed ties with certified Android TV device manufacturer Videostrong after discovering a built-in malware backdoor across millions of hardware units.
Radwan AbdulhadiEditor and technology writer
Google Cuts Ties With Device Maker Over Backdoor
In a post today, Google confirmed that it has officially severed its relationship with “Videostrong,” a company that manufactured certified Android TV equipment. The action follows the discovery that the manufacturer built a malicious backdoor into its hardware, allowing it to sell access and distribute malware to unsuspecting users.
Google revealed that the malicious software was embedded directly into multiple device models and brands over a span of several years. Supported by dedicated infrastructure and constantly evolving configurations, the operation was designed to evade detection and efficiently manage affiliates. Google explicitly stated that this campaign was neither an isolated rogue insider action nor a simple development oversight, prompting a complete ban on Videostrong and its subsidiaries from creating devices with preloaded Google apps.
Legal Action and Botnet Disruption
To neutralize the ongoing threat, Google took decisive legal action to block the specific servers and domains that Videostrong utilized to control the XCPE botnet and associated malware modules. According to the company, taking down these command-and-control domains successfully severs access to at least 10 million additional compromised devices across the ecosystem.
Security researchers at Synthient, as detailed by The Hacker News, compiled comprehensive lists of potentially affected devices. Their research highlighted hardware primarily under the Mecool brand, which has produced several well-known Android TV and Google TV options in the past. Rumors have since suggested that Mecool may be shutting down operations.
Addressing Security Gaps and Future Tests
Google candidly acknowledged that the incident highlights a failing in its previous evaluation frameworks, given that these units were originally sold under the trusted banner of certified Android devices. The company explained that the bad actors implemented sophisticated obfuscation techniques designed specifically to exploit a gap in existing testing protocols, loading malicious code only after the device completed its initial boot sequence.
Emphasizing that a device manufacturer intentionally infecting users with malware represents an unacceptable breach of trust, Google is actively updating its review process. These modifications are intended to strengthen defenses and protect the broader ecosystem against similar deceptive behaviors moving forward.
Impact on Consumers and Ecosystem Safety
While Google's shutdown of the malicious domains renders affected hardware safe to use from a control standpoint, industry observers note that owners of impacted Android TV and Google TV hardware may still wish to explore alternate options for long-term security. The widespread enforcement actions signal a rigorous shift in how platform compliance and device certification are monitored.
Sources
- 9to5GoogleGoogle shuts down a sneaky malware backdoor on millions of Android TV and Google TV boxes
Continue chronologically
Related entity coverage
Related stories
Google Disrupts XCPE Malware Botnet and Bans TV Box Maker
Google and industry partners dismantle the 1.3 million-device XCPE Android malware botnet, banning Chinese manufacturer Videostrong Technology.
Google Dismantles XCPE Botnet of 1.3 Million Android Devices
Google has dismantled the 1.3 million-strong XCPE botnet created by Videostrong Technology, banning the OEM from preloading Google apps.
Google Cuts Ties After Partner Turns 1.3M Devices Into Botnet
Google dismantles a covert backdoor built by an Android partner, which turned 1.3 million set-top boxes and IoT devices into an active financial botnet.
Chromecast with Google TV gets first 2026 update
Google is rolling out its first update of 2026 to the Chromecast with Google TV 4K model, bumping the Android Security Patch to August 2026.
