Google bans Videostrong for hiding backdoor in 1.3 million certified Android TV boxes

DAMAKORONKOWA - More than 1.3 million households across 200-plus countries are running Android TV set-top boxes with permanent backdoor firmware — installed at the factory, hidden from Google's certification team, and sold by the manufacturer to criminal affiliates who used it to route illegal traffic through victims' home internet connections. That is the finding Google's Threat Intelligence Group published Monday, November 2, in a disclosure that also announced the permanent banning of Shenzhen-based Videostrong Technology Co. from Google's certified Android ecosystem.

The case is the first documented instance of a Play Protect-certified manufacturer deliberately embedding a botnet into certified hardware — not cheap uncertified boxes sold on gray markets, but devices that passed Google's own security and compatibility tests. Every prior documented Android TV botnet — BADBOX, Vo1d, and the NetNut/Popa campaign disrupted in July 2026 — infected uncertified AOSP hardware. Videostrong moved the threat inside Google's trust boundary.

What Videostrong Built Into Your TV Box

The backdoor, named XCPE by Google researchers, lives inside a package called x.cpe (also identified by the package name com.oemservice) and runs at Android's system privilege. That level — android.uid.system — gives it authority that no user-installed app can match. A user cannot remove it; attempting to uninstall triggers automatic reinstallation from a protected partition on the device.

The architecture ran in three stages per GTIG's three-stage architecture analysis. The primary backdoor collected the device's serial number, MAC address, model identifier, and firmware version via an encrypted request to Videostrong's servers. In return it received configuration for a second-stage loader called com.abc.nexus, which handled monetization. The third stage delivered affiliate-built malware modules — the actual criminal payloads — as native software libraries, embedded code kits, or additional apps.

Once active, XCPE's capabilities included silent installation of any app without user knowledge or Play Protect screening, arbitrary command execution with root-equivalent authority, remote screen capture sent as JPEG images over the internet, keystroke injection, credential and account information collection, full network reconnaissance of the victim's local network, and opening a reverse shell that gave Videostrong operators real-time access to the device. Play Protect — the Android security scanner that users see as a reassuring badge in the Settings menu — was disabled to block XCPE detection.

The primary criminal use of the access was residential proxy enrollment — routing third-party internet traffic through the victim's home IP address, per GTIG's proxy service documentation. Named proxy services whose infrastructure ran through XCPE-enrolled devices include Linkfog, Jaguar, AppSalt/Honeygain, BWM/IPWeb, GaGaNode/IPCola, NetNut/Popanet, Traffmonetizer, and EarnFM. When a criminal rents access to a residential proxy exit node, traffic that appears to come from the victim's home connection can include account-takeover attempts, scraping operations, and attacks that would otherwise be blocked at corporate or government network perimeters.

How Videostrong Passed Google's Tests

Google requires Android TV device makers to pass compatibility and security tests before they may ship hardware with Google apps and Play Protect certification. Videostrong submitted devices for testing with the XCPE backdoor dormant. The malicious code was loaded only after first boot, after the certification window had closed. Google has since changed its review process and tightened firmware integrity checks on certified Android TV devices, but cannot remediate already-shipped Videostrong devices.

In August 2026, the operation escalated. New dropper packages appeared — disguised as system-level Android utilities with names like com.android.system.ntp and com.android.sso.auth.handler — that bundled a root escalation library called libexploit.so. That file restarted Android's debugging interface as a root process, then used it to remount the device's /system partition as writable and install new software directly into a protected system folder. It then created a permission file granting itself the right to install any package and reboot the device at will. Devices infected after August 2026 had their core system partition permanently modified; removing the backdoor code now requires a complete firmware reflash from a clean source.

How Google and Security Researchers Traced It to Videostrong

The investigation began with Plume, a network security company, detecting an anomalous MQTT traffic pattern — multiple unrelated Android TV devices communicating with the same unfamiliar domain using MQTT, a lightweight messaging protocol designed for IoT devices that is not typically used by Android TV consumer apps for persistent server connections.

A parallel investigation by Synthient, working alongside Google, traced the operation to Videostrong through three independent evidence threads: a GitHub account named yf-videostrong that hosted botnet distribution packages; a Videostrong corporate web domain that shared an IP address with the operators' control panel; and a technical document found in an open folder on one of the botnet's servers — signed by Videostrong's own research and development director.

"We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology," Google's Threat Intelligence Group wrote in its November 2 disclosure. The assessment was supported by Japan's National Police Agency, which participated in the coalition that disrupted the botnet's command-and-control infrastructure in late October 2026.

The infected devices were overwhelmingly Android TV set-top boxes, but the XCPE backdoor also appeared on telehealth devices and karaoke machines and digital signage displays — all categories where Videostrong operated as an ODM, making hardware for other brands under contract. Google's analysis found a specific check for the ro.mecool.device system property, confirming Mecool-branded devices were targeted directly.

A Structural Problem, Not Just a Single Bad Actor

The XCPE case reveals something that extends beyond Videostrong: Google's certification framework, which evaluates device firmware at a single point in time before deployment, cannot systematically detect backdoors that activate only after first boot. Videostrong exploited that gap deliberately. Any other certified OEM or ODM could have done the same thing, and consumers and enterprise buyers would have had no way to detect it.

Google has changed its review process to close the certification gap, but the 1.3 million already-shipped devices remain in the field with backdoor firmware, and consumers who purchased them have no mechanism for a recall or manufacturer remediation — Videostrong is now banned from the ecosystem. The only complete remedy for a device compromised after August 2026 (when libexploit.so began modifying the /system partition) is a full firmware reflash from a verified clean source. For devices compromised only at the x.cpe level, taking down the C2 servers severs current criminal control but leaves the dormant backdoor code in place, available to whoever establishes a new command infrastructure.

Taking down the XCPE botnet's affiliate command infrastructure — beyond Videostrong's own servers — also severed access to 10 million additional devices enrolled through those affiliates' separate distribution channels. The XCPE campaign was part of the same Android TV botnet ecosystem as BADBOX 2.0 disrupted March 2025 by Human Security, Google, and TrendAI, and which Google followed with a lawsuit against 25 Chinese entities in July 2025.

What Google Did

Google's response included four coordinated enforcement actions:

Legal action against the domains and servers Videostrong used to operate the XCPE botnet and deliver malware modules to enrolled devices.

Legal action against the command-and-control infrastructure used by more than a dozen malware families that distributed their payloads through the XCPE backdoor.

A permanent ban on Videostrong Technology Co. and any future subsidiaries or affiliates from building or selling certified Android devices, or from supplying firmware or software to any other certified device manufacturer.

Changes to Google's certification review process for Android TV manufacturers, including improved firmware integrity checks designed to detect post-boot malware activation.

As of November 2, Videostrong's own website still listed products described as "Google Certified Android TV Box" and "Google Certified Android TV Stick," with Videostrong's revoked certification confirmed by Google's November 2 enforcement action.

What Chinese Law Means for Any Videostrong Device in Your Home

Videostrong Technology Co. is headquartered in Shenzhen, China. As a Chinese company, it is subject to China's 2017 National Intelligence Law, which states in Article 7 that "all organizations and citizens shall support, assist, and cooperate with national intelligence efforts in accordance with law." Article 14 of the same law authorizes intelligence agencies to demand that organizations provide this support. Article 28 makes obstruction of intelligence work a criminal offense under law.

Separately, China's Cybersecurity Law (2017) includes data localization and government-access provisions, and its Data Security Law (2021) requires cooperation with government data requests.

These obligations apply regardless of where Videostrong's servers are located, regardless of any privacy policy the company has stated, and regardless of its certification status with Google. They are fixed legal conditions of operating as a Chinese company. Whether or not Videostrong has provided Chinese intelligence agencies with data collected through the XCPE backdoor — which included hardware identifiers, account credentials, screen captures, and full network topology of victims' home networks — is not knowable from outside. The legal obligation to do so exists and cannot be waived by the company unilaterally.

The data categories collected through XCPE backdoor that could be subject to government demand include: device serial numbers and MAC addresses; account credentials and session tokens captured from services authenticated through the device; screenshots of device activity; keystroke data (inferred from the keystroke injection capability); the full topology of the victim's home network; and installed application inventories.

For readers who own any Videostrong-manufactured device: This legal framework is the reason Google's remediation — banning Videostrong and taking down C2 servers — does not fully resolve the privacy risk. The data already collected through XCPE, and the structural legal obligation that applied to Videostrong as a Chinese company throughout the botnet's operation, are facts that existed independently of Google's enforcement action.

What Owners Should Do Right Now

Check whether your Android TV box was manufactured by Videostrong. Brand names associated with Videostrong include Mecool and YOKATV. Affected devices identified by GTIG include models with the ro.mecool.device system property and devices with pre-installed packages x.cpe, com.oemservice, or com.abc.nexus.

Verify your device appears on Google's official Android partner list.

If your device was purchased before the disruption, the C2 servers that gave Videostrong operators remote access have been taken down. The backdoor code itself has not been removed from your device. For devices that received the August 2026 or later dropper packages — those with modified /system partitions — the only complete remediation is a full firmware reflash using a verified, independently sourced firmware image. Because Videostrong is now banned from the certified ecosystem, treat any firmware update attributed to Videostrong with caution and verify its source independently.

At the network level, isolating any suspected device on a separate guest network prevents it from being used to access other devices on your home network, even if the backdoor remains.

For businesses and organizations that deployed Videostrong ODM hardware in telehealth, digital signage, or commercial display contexts: the backdoor ran with system-level privileges and captured network topology. An independent security audit of the network segment where those devices operated is warranted.

Frequently Asked Questions

How do I know if my Android TV box is infected with XCPE?

XCPE ran on certified Android TV set-top boxes manufactured by Videostrong Technology Co., sold under the Mecool and YOKATV brand names and through ODM arrangements with other companies. Check whether your device appears on Google's Android certified partner list — Videostrong has been removed. If you have ADB access, check for the packages x.cpe, com.oemservice, or com.abc.nexus. Devices infected after August 2026 may also have modified /system partitions containing com.android.system.ntp or com.android.sso.auth.handler. If those packages are present, C2 takeover has been disrupted but the code has not been removed.

Can I remove the XCPE backdoor myself?

For devices infected only at the primary backdoor level (x.cpe), criminal network access was cut when Google took down the C2 servers in late October 2026. The backdoor code remains on device but is currently dormant. For devices infected after August 2026 — when the backdoor began using libexploit.so to rewrite the device's /system partition — a complete firmware reflash from a verified clean source is the only full remediation. Ordinary uninstall procedures will not work; x.cpe reinstalls itself from a protected device partition on reboot. Because Videostrong is now banned from the certified ecosystem, verify any firmware source independently before flashing.

Why does it matter that these boxes are "certified" rather than cheap uncertified ones?

Every previous major Android TV botnet — BADBOX, Vo1d, NetNut/Popa — infected uncertified, off-brand boxes that never went through Google's security review. Consumers who knew to buy only Play Protect-certified hardware were following Google's own advice. XCPE is the first case of a manufacturer that passed Google's tests delivering a backdoor anyway, by hiding the malicious code until after the certification window. This means that for a period, the certification badge did not protect buyers from the manufacturer itself. Google has changed its review process to close that gap, but the 1.3 million already-shipped devices cannot be recalled.

Does this mean other certified Android TV manufacturers could have done the same thing?

Yes — that is the structural finding Google's disclosure implicitly reveals. The certification gap that Videostrong exploited (activating malware only after first boot) was a property of the certification framework, not a unique vulnerability in Videostrong's hardware. Any certified OEM or ODM could have used the same technique. Google has now changed its review process to detect post-boot activation, but the existence of the gap prior to this disclosure means it cannot be ruled out that other manufacturers exploited it without yet being detected.

 

Location:

Share :