Google says the XCPE backdoor was embedded in device firmware before sale, allowing cybercriminals to exploit infected TV boxes for illegal traffic, advertising fraud and surveillance.
Highlights
- Google uncovers factory-installed malware affecting around 1.3 million Android devices.
- Android TV box manufacturer Videostrong permanently banned from Google’s certification programme.
- XCPE backdoor was reportedly embedded in firmware during manufacturing.
- Infected devices included TV set-top boxes, karaoke machines and digital signage.
Google has uncovered a major cybersecurity threat involving approximately 1.3 million Android devices, primarily TV set-top boxes, that were allegedly infected with malware before reaching consumers. Following the discovery, the technology giant has permanently banned device manufacturer Videostrong from producing Google-certified Android devices or licensing Google services.
According to information shared by Google Cloud, Videostrong, which manufactures devices under brands including MECOOL and YOKATV, allegedly installed malicious software known as the XCPE backdoor directly into device firmware during production.
Malware Installed Before Devices Reached Customers
Unlike conventional malware that infects devices through suspicious applications or downloads, the XCPE backdoor was embedded in system files at the factory.
This meant affected devices were already compromised when customers purchased them.
Google said the malicious code was designed to activate only after the first boot, helping it evade standard security checks during device certification.
How Cybercriminals Used Infected Devices
According to Google’s findings, Videostrong operated a commercial botnet service that provided criminal affiliates access to more than 1.3 million compromised devices.
These devices were allegedly used to route illegal internet traffic through residential IP addresses, generate fraudulent advertising revenue and conduct surveillance.
Attackers could also capture screens, record keystrokes, collect account information and execute commands remotely.
The affected hardware reportedly included Android TV boxes, karaoke machines and digital signage equipment.
Google Blocks Access to Millions of Devices
Google said its action against shared command-and-control infrastructure disrupted attackers’ access to more than 10 million additional compromised devices worldwide.
The company has also strengthened its Android TV firmware review process to detect malicious software designed to activate after a device starts operating.
Videostrong and its future subsidiaries have been barred from Google’s device certification and licensing programmes.
How Android TV Users Can Stay Safe
Google has advised consumers to purchase Android TV devices from reputable manufacturers and verify whether their brands appear on its official Android TV partner list.
Users should also keep Google Play Protect enabled, download applications only from trusted stores and carefully review permissions requested by VPN or proxy applications.
The company particularly warned against apps offering payments for sharing unused internet bandwidth, as such services can expose home networks to cybercriminal activity.
The incident highlights the growing risks associated with uncertified and low-cost connected devices, particularly when malicious software is embedded during manufacturing.
