Hidden Malware Found in More Than 1.3 Million Android TV Boxes, Google Investigation Names Videostrong

More than 1.3 million Android TV boxes worldwide had hidden malware installed in them from the start, according to a Google investigation. A November 2 report from Google's Threat Intelligence Group concluded with high confidence that a device manufacturer deliberately installed hidden software inside streaming hardware.

Google says the operation involved Videostrong Technology, a China-based company that manufactures Android-powered devices for different brands. Google assesses with high confidence that the company deliberately operated a backdoor called XCPE for financial gain.

That backdoor gave outsiders remote access to devices without the owners knowing. Some affected products had made it through Google's own security certification process.

According to Google, Videostrong sold access to compromised devices to criminal affiliates, who installed additional malware and turned those products into part of a botnet, a network of infected devices controlled remotely without their owners' permission.

Investigators say the company concealed malicious software during testing. The backdoor then loaded additional malicious code after the device's first startup, exploiting a gap in Google's review process.

The malware could also disable Google Play Protect app verification, one of Android's built-in defences. Because XCPE was embedded in the device firmware, removing the visible malware package could lead the system to reinstall it after a reboot, so even a factory reset might leave the underlying infection intact.

Criminals used infected devices for residential proxy networks, routing their internet activity through another person's home connection so suspicious activity appeared to originate from that household. Google also found malware capable of generating fake advertising activity, secretly loading ads or simulating interactions to generate revenue for the operators.

Other capabilities were more invasive. Researchers observed operators capturing screenshots, injecting keystrokes and collecting sensitive account information from compromised devices, and they could also install additional software remotely.

Cybersecurity company Synthient published its own investigation identifying specific hardware. Researchers who purchased and examined a MECOOL KM9PRO Max Android TV streaming box in late 2025 found the XCPE backdoor preinstalled under the package name com.oemservice, on firmware version C1.0.8_20250325. Synthient warned that a matching model name alone cannot confirm that an individual device is compromised.

The investigation also identified infections in Android-powered karaoke machines, digital signage equipment and some telehealth devices. Google says the malware appeared across many models and brands over several years.

Google worked with Japan's National Police Agency and several cybersecurity companies to dismantle the XCPE operation, taking legal action to shut down the domains and servers Videostrong used to control infected devices and install malware. Action against command-and-control domains associated with more than a dozen additional malware families was expected to sever criminal access to at least 10 million other compromised devices.

Google also cut ties with Videostrong and banned the company, along with future subsidiaries and affiliates, from building or selling certified Android devices or supplying software to other certified vendors, and said it has strengthened how it verifies the integrity of firmware on certified Android TV devices. Disrupting the control servers, however, does not automatically remove malicious firmware from devices already in people's homes.