1.3 Million Android TV Boxes Have a Backdoor That a Reset May Not Fix

Imagine buying a TV box, plugging it in and starting to stream, only to discover that someone else has been controlling it. That was the reality for owners of more than a million Android devices affected by a newly uncovered botnet.

Google has disrupted a botnet involving more than 1.3 million Android devices, mostly TV set-top boxes.

The manufacturer, Videostrong Technology, is accused of deliberately embedding a backdoor in the devices' firmware. That means the malware was already there before customers even opened the box.

What Is a Zero-Day Vulnerability? How Undiscovered Exploits Threaten CybersecurityA zero-day vulnerability is a software security flaw that's unknown to the vendor and unpatched at the time it's discovered or exploited.

How it happened

Videostrong Technology is a Shenzhen-based manufacturer that builds Android TV boxes and other devices for multiple brands. According to Google, the company deliberately embedded a backdoor called x.cpe into the firmware. In some versions, the malware runs under the name com.oemservice.

The backdoor disguised itself as a legitimate remote-management agent. Videostrong used obfuscation techniques to get around Google's pre-release security tests, allowing the malicious code to load after a device's first boot.

"We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates," Google's Threat Intelligence Group said.

Videostrong allegedly went further than installing the backdoor. Google says the manufacturer sold access to criminal affiliates, who then loaded their own malware modules onto infected devices. These modules were used for advertising fraud, residential proxy networks and additional malware distribution.

What the botnet did

The infected devices were turned into residential proxy nodes. This meant strangers could route their internet traffic through someone else's home connection, using the owner's IP address and bandwidth without their knowledge.

Residential proxies are particularly useful to cybercriminals because traffic appears to come from an ordinary household internet connection rather than a data centre. This can help them evade security checks, commit fraud and disguise their online activity.

The operators could also install apps silently, execute shell commands, capture live screenshots, inject keystrokes and collect information from the devices. Google says it observed operators using these capabilities to access account details, device information, installed app lists and system logs.

TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1, 2026. The company also recorded more than 3.8 million distinct home and mobile IP addresses connected to the operation during that period.

One TV box could generate revenue through several services at once, while its owner saw nothing unusual beyond a working streaming device.

Why you can't just delete it

This is the part that probably matters most to users. The backdoor runs as a system app inside the device's firmware and has system-level privileges. It is also signed with the manufacturer's key.

If a user uninstalls it, the malware can reinstall itself from a protected firmware partition when the device restarts. It also disables Google Play Protect's app verification, making it easier to install additional software without the owner's knowledge.

A factory reset may remove some of the additional malware modules, but it does not guarantee that the original backdoor will disappear. Plume recommends a full factory reset to deal with potentially installed modules, while Synthient advises users to disconnect and dispose of affected devices.

In other words, resetting the box is not a reliable way to remove the underlying infection. Replacing it is the safer option.

What Google did, and what it didn't do

Google worked with Japan's National Police Agency and security firms including Lumen, HUMAN Security, Plume, Synthient and TrendAI to disrupt the operation.

It took legal action to shut down the domains and servers Videostrong used to control the botnet and install malware. It also disrupted the command-and-control domains used by more than a dozen malware families distributed through the backdoor.

Google has banned Videostrong and any future subsidiaries or affiliates from building and selling certified Android devices or supplying software to other certified manufacturers. It has also changed its firmware review process to prevent similar activity from slipping through its security checks.

However, the takedown does not remove the backdoor from devices already sold. Google says the disruption could also cut off access to at least 10 million additional compromised devices connected to the criminal affiliates' other malware operations.

There is another important detail: the affected devices were not all uncertified products. Plume found that the botnet included both Google-certified devices and those running the Android Open Source Project (AOSP). Google has not disclosed how many certified devices were affected.

What you should do if you think you're affected

First, check your device. If you own a MECOOL TV box or another model from Synthient's published list of 182 device names associated with the campaign, investigate further. A match does not automatically mean your device is infected, but it is a reason to be cautious.