Google finds malware in 1.3 million Android devices: Is your TV at risk?

Your Android TV box may be doing more than streaming films and television programmes. Google has uncovered a malware operation involving more than 1.3 million Android-based devices, in which a Chinese manufacturer allegedly installed a hidden backdoor before products reached consumers. The campaign involved Shenzhen-based Videostrong Technology. According to Google, the malware allowed criminal affiliates to access users' devices and internet connections without their knowledge. Google said it assessed with high confidence that the operation was deliberately developed and operated for financial gain. It has since banned the company from building or selling certified Android devices or supplying software for them.

How did the Android malware work?

Google identified the backdoor as XCPE. It was embedded in device firmware at the manufacturing stage, meaning it could be present before a customer switched on the device for the first time. Once activated, the malware could gain system-level access and silently install applications, execute commands, capture screens and collect account and device information.

It also turned infected devices into part of a botnet a network of compromised devices controlled by attackers. Criminals could use this network for advertising fraud, data theft, unauthorised traffic routing and the installation of additional malware. In some cases, infected devices could act as residential proxies, allowing outside traffic to pass through a user's home internet connection.

Which devices and countries were affected?

Most infections were found on Android TV set-top boxes. However, Google also identified the malware on telehealth devices, karaoke machines and digital signage systems. The campaign affected devices across more than 200 countries and involved several models and brands over multiple years. Google has not publicly named the specific products or brands involved. Videostrong describes itself as an original equipment and design manufacturer. Its website says its products serve more than 100 million households across over 60 countries.

Has Google removed the Android botnet?

Google said it worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI to disrupt the operation. The partners targeted the infrastructure controlling the botnet, including command-and-control domains. Google also said the operation disrupted access to at least 10 million additional compromised devices distributed through channels outside XCPE. The company has banned Videostrong from its certified Android device programme and is strengthening firmware integrity checks. Google has advised consumers to buy connected devices, including TV boxes, from reputable manufacturers. The incident highlights a wider security risk: malware can enter a device before it reaches a customer's home, making the manufacturer's software and firmware checks just as important as the user's own security practices.