November 5, 2026, 4:52 pm | Read time: 2 minutes
A pre-installed backdoor has turned more than 1.3 million Android devices into a botnet. The primary targets were Android TV boxes. Additionally, the malware appeared on telemedicine devices, karaoke machines, and digital advertising displays.
According to Google, the backdoor was not inserted later. The company holds the Chinese manufacturer Videostrong Technology responsible, claiming it deliberately developed the backdoor and integrated it into firmware for various devices and brands over the years.
What the Backdoor Could Do on the Devices
Technically, the backdoor is particularly problematic because it allowed extensive system rights. Attackers could install apps unnoticed and execute commands. Screen recordings were also possible. Additionally, Google observed access to account and device information as well as system logs.
The malware also disabled Google Play Protect, allowing further malicious apps to be installed. A key goal was apparently to use the compromised devices for ad fraud and as so-called residential proxies.
Android TV Boxes from China Have a Major Malware Problem
Google Accidentally Releases Code for Dangerous Browser Vulnerability
Why Residential Proxies Are Problematic
With a residential proxy, internet traffic is rerouted through another person’s private connection. For online services, it appears as if the request comes directly from their home connection–often without the affected person noticing.
Also of interest: Get rid of the ads! AI streamlines smart TV menus
Google, along with security firms and the Japanese police, took action against the infrastructure. In addition to servers of the XCPE botnet, systems of other malware were shut down. As a result, the operators reportedly lost access to at least ten million additional compromised devices.
How Users Can Respond
Google does not publish a complete list of models. Therefore, it is difficult for owners of an Android TV box to determine if their device was affected. Google has since ended its collaboration with Videostrong and adjusted its testing procedures for Android TV firmware.
However, the case highlights a fundamental problem. Videostrong was previously Google-certified. Even when purchasing seemingly trustworthy devices, pre-installed malware is difficult for consumers to detect.