{"id":751380,"date":"2026-11-04T16:45:29","date_gmt":"2026-11-04T13:45:29","guid":{"rendered":"https:\/\/buradabiliyorum.com\/en\/google-says-a-certified-partner-turned-1-3m-android-tv-boxes-into-a-botnet\/"},"modified":"2026-11-04T16:45:29","modified_gmt":"2026-11-04T13:45:29","slug":"google-says-a-certified-partner-turned-1-3m-android-tv-boxes-into-a-botnet","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/google-says-a-certified-partner-turned-1-3m-android-tv-boxes-into-a-botnet\/","title":{"rendered":"Google says a certified partner turned 1.3M Android TV boxes into a botnet"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6aeca005a2728\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6aeca005a2728\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/google-says-a-certified-partner-turned-1-3m-android-tv-boxes-into-a-botnet\/#What_the_backdoor_did\" >What the backdoor did<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/google-says-a-certified-partner-turned-1-3m-android-tv-boxes-into-a-botnet\/#Germany_and_the_UK_among_the_targets\" >Germany and the UK among the targets<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/google-says-a-certified-partner-turned-1-3m-android-tv-boxes-into-a-botnet\/#A_gap_in_Googles_tests\" >A gap in Google\u2019s tests<\/a><\/li><\/ul><\/nav><\/div>\n<p><img decoding=\"async\" src=\"https:\/\/media.thenextweb.com\/2026\/11\/hand-remote-streaming-tv-menu-blurred.avif\" \/><\/p>\n<div id=\"article-main-content\">\n<p>Google and its partners have shut down XCPE, a botnet that ran on more than 1.3 million Android TV boxes. Google says the device maker built it in on purpose, its Threat Intelligence Group wrote in a <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/shutting-the-door-on-the-xcpe-botnet\/\" target=\"_blank\" rel=\"nofollow noopener\">blog post<\/a> on Monday.<\/p>\n<blockquote>\n<p>\u201cA device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users,\u201d Google wrote.<\/p>\n<\/blockquote>\n<p>The maker is Videostrong <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/technology\/\" data-internallinksmanager029f6b8e52c=\"4\" title=\"Technology\" target=\"_blank\" rel=\"noopener\">Technology<\/a>, a Shenzhen company that builds Android TV boxes and other devices. Google said it has high confidence that Videostrong developed and ran the backdoor for profit, and sold access to criminal affiliates. It found the code in many device models and brands over several years.<\/p>\n<blockquote>\n<p>\u201cWe believe this campaign wasn\u2019t an isolated rogue insider or a development oversight,\u201d Google wrote.<\/p>\n<\/blockquote>\n<p>Google has cut ties with Videostrong. It banned the company, and any future subsidiaries or affiliates, from building certified Android devices or supplying software to other certified makers.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_the_backdoor_did\"><\/span>What the backdoor did<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The backdoor, x.cpe, sits in the firmware with system-level access and reinstalls itself if a user deletes it. It turned off Google Play Protect, Android\u2019s built-in <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a> scanner, so it could install apps without the owner knowing.<\/p>\n<p>Videostrong then loaded its affiliates\u2019 modules onto the boxes. Most turned them into residential proxies. These rent out a home\u2019s internet connection, so other people\u2019s traffic looks like it comes from an ordinary household. Others faked views of online ads.<\/p>\n<p>Google said it also saw Videostrong\u2019s operators take live screenshots, inject keystrokes and copy account details and system logs. The backdoor could map the home network a box sits on. LG said in September that its smart TVs scan home networks and that every smart TV does.<\/p>\n<p>Most infected devices were set-top boxes. The backdoor also turned up on telehealth devices, karaoke machines and digital signage.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Germany_and_the_UK_among_the_targets\"><\/span>Germany and the UK among the targets<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Google worked with Japan\u2019s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. It used legal action to take down Videostrong\u2019s control servers. It also took down the control domains of more than a dozen malware families loaded through the backdoor. Google expects that to cut criminals off from at least 10 million more infected devices.<\/p>\n<p>The takedown came weeks after Microsoft disrupted Chinese-language phishing kits behind 1bn scam messages.<\/p>\n<p><a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.trendaisecurity.com\/en-us\/resources-insights\/trendai-security-blog\/trendaitm-research-helps-disrupt-android-tv-botnet-of-more-than-13-million-pre-infected-devices\" target=\"_blank\" rel=\"nofollow noopener\">TrendAI<\/a>, Trend Micro\u2019s enterprise business, counted 1,472,554 infected devices across 206 models between June and October. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The US, Germany, the UK, Australia and Canada each had about 26,000 to 42,000.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"A_gap_in_Googles_tests\"><\/span>A gap in Google\u2019s tests<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Videostrong was a certified Android maker, which means its devices go through Google\u2019s compatibility and security tests. Google said Videostrong hid its code to exploit \u201ca gap in our tests\u201d and loaded it after a device\u2019s first boot. Google has changed its review process and is improving its firmware checks on certified Android TV devices. The gap surfaced weeks after Google added Gemini scam checks to Android calls and Messages.<\/p>\n<p>On 2 November, Videostrong\u2019s website still listed products it called \u201cGoogle Certified Android TV Box\u201d, <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/thehackernews.com\/2026\/11\/google-disrupts-13-million-device.html\" target=\"_blank\" rel=\"nofollow noopener\">The Hacker News<\/a> reported.<\/p>\n<p>The takedown cuts the operators off, but it does not clean the boxes. TrendAI said owners cannot remove the backdoor themselves, because it runs as a system app signed with the maker\u2019s key. Synthient, which links the MECOOL brand to Videostrong, has published a <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/github.com\/synthient\/public-research\/blob\/main\/2026\/11\/Videostrong\/README.md\" target=\"_blank\" rel=\"nofollow noopener\">list of 182 model names<\/a> seen in the campaign. It warns that a model name alone does not confirm a box is infected.<\/p>\n<\/p><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMN63nwsw68G3Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/buradabiliyorum.com\/en\/category\/technology\/\" target=\"_blank\" >Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/thenextweb.com\/news\/google-videostrong-xcpe-botnet-android-tv-boxes\" target=\"_blank\" >Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Google and its partners have shut down XCPE, a botnet that ran on more than 1.3 million Android TV boxes. Google says the device maker built it in on purpose, its Threat Intelligence Group wrote in a blog post on Monday. \u201cA device manufacturer intentionally infecting their users with malware is an unacceptable breach of&#8230;<\/p>\n","protected":false},"author":1,"featured_media":751381,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/media.thenextweb.com\/2026\/11\/hand-remote-streaming-tv-menu-blurred.jpg","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-751380","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/751380","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=751380"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/751380\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/751381"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=751380"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=751380"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=751380"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}