Google’s Android-based TV operating system is a popular choice for manufacturers as a TV OS across the world. Beyond pre-installation, the company also offers the OS to partners for integration into connected devices, such as set-top boxes, and this is a point of Google’s recent concern. A partner, Videostrong Technology, which installed the software on a set-top box, also shipped it with a botnet, infecting over a million devices. Google has said it has severed ties with the partner.
In a blog post, the company said it dismantled the XCPE backdoor that is said to have enrolled over 1.3 million set-top boxes. The tech giant added that the botnet and the backdoor were deployed “intentionally” for financial benefits by the Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM). Videostrong sold the backdoor access to criminal actors, leading to the installation of orchestrated malware on the infected devices.
The modules were engaging in ad fraud by enrolling these devices in proxy networks and further deploying malware on the XCPE-compromised devices. The company said it is severing access of the boxes from the command and control (C2) domains to limit access to at least 10 million additional compromised units. Google noted this software is directly built into device models and brands. “Google has cut ties with Videostrong and banned them from making devices with preloaded Google apps,” the tech giant noted.
Videostrong is said to have exploited a gap in Google’s testing and injected malicious code after the product’s first boot. As a result, the company implemented changes in the review process for better safeguards. “A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users,” it added.
Videostrong’s malware has been active since late 2024 and has transformed into pre-installed malware using a three-stage architecture. Google recommended that users stay cautious of apps that offer money for your “unused bandwidth” or “sharing your internet.” These can trigger security vulnerabilities on the source device.
To stay safe, Google noted that users should only download apps from official app stores, review permissions of apps and proxies and ensure Google Play Protect is active on their device. Lastly, it noted that users should only purchase connected devices (including set-top boxes) from reputable manufacturers. Further, Videostrong users should consider replacing their devices.