Google Bans TV Box Maker Behind 1.3-Million-Device Android Botnet

Over a million Android TV boxes sitting under televisions around the world had a backdoor built straight into their firmware — and the company behind it wasn't some anonymous factory in a grey-market supply chain. It was a certified Android manufacturer, in good standing with Google, quietly selling access to the botnet it had created.

Google's Threat Intelligence Group says it has dismantled a network of more than 1.3 million compromised Android-based devices, nicknamed the XCPE botnet, and banned the manufacturer it holds responsible: a Shenzhen-based company called Videostrong Technology. The devices weren't just TV boxes either — Google says the same backdoor turned up in telehealth equipment, karaoke machines, and digital signage systems running Android under the hood.

A backdoor with a business model

What makes this case stand out from typical IoT malware is the source. Most botnets built on cheap smart devices trace back to uncertified hardware — knockoff gadgets that never went through any official review. Videostrong, by contrast, was a legitimate, Google-certified original device manufacturer (ODM), meaning it was trusted to build Android devices that carry Google's own compatibility badge.

Google's investigators say Videostrong built the malicious code directly into its firmware across multiple device models and brands over several years, then rented out access to the resulting botnet for profit. A botnet, for anyone unfamiliar with the term, is simply a network of hijacked devices that can be remotely commanded without their owners knowing — used for things like relaying spam, scraping data, or disguising other criminals' internet traffic as ordinary consumer activity.

"We found this malicious software built directly into many different device models and brands over multiple years," Google's Threat Intelligence Group wrote in its report on the takedown.

Google says it pursued legal action to seize the domains and servers controlling the botnet, and has permanently barred Videostrong — along with any future shell companies or affiliates — from building certified Android hardware or supplying software to other certified vendors. The company estimates the broader cleanup could cut off access to at least 10 million additional compromised devices tied to the same criminal ecosystem, which echoes the BadBox 2.0 botnet Google sued over last year, though that operation ran on uncertified devices rather than ones carrying official certification.

Why this matters more in India than it might seem

India is one of the biggest markets anywhere for exactly this category of device. Budget Android TV boxes and streaming sticks — many from lesser-known Chinese brands sold heavily through Amazon, Flipkart, and local electronics markets — are how a huge number of Indian households add smart-TV features and OTT apps to an older television. That price-driven buying pattern is precisely the profile Google describes: cheap, white-label hardware made by manufacturers nobody outside the supply chain has heard of, running on firmware nobody outside the factory has audited.

There's no indication yet that Videostrong units were sold under Indian retail listings specifically, but the broader lesson applies directly: a device being "Android certified" is not, by itself, proof that nothing was tampered with before it left the factory. For a market where CERT-In has repeatedly flagged risks from low-cost connected hardware, and where the DPDP Act is pushing companies to account for how personal data moves through devices they don't fully control, this is a reminder that the weak link in device security can sit upstream of the user entirely — at the manufacturing stage, not the app store.

What changes going forward

Google says it has also tightened its own processes in response:

• Stronger firmware integrity checks specifically for certified Android TV devices
• Changes to its manufacturer review process aimed at catching preloaded malware before certification is granted
• Continued monitoring of the domains and infrastructure linked to the broader XCPE/BadBox ecosystem

For context on how seriously Google is treating Android's security posture lately, this takedown lands just days after the November Android security update patched 216 separate vulnerabilities, one of which needed no user interaction at all to exploit. Between that patch cycle and this manufacturer ban, it's clear Google is trying to plug holes at both ends of the stack — the operating system and the hardware supply chain.

None of this means every budget streaming box is secretly a botnet node. Most aren't. But if a device feels unusually cheap for what it claims to do, runs ads or firmware updates you never asked for, or came from a brand you can't find much about online, that's worth treating as a signal, not a bargain. The device sitting quietly under your TV is still a computer on your network — and this case is a reminder that the company that built it, not just the app you downloaded onto it, can be the one deciding what it does when nobody's watching.