Google disrupts Android TV botnet tied to device maker Videostrong

Who is affected

Over 1.3 million Android devices, mostly TV set-top boxes, were part of the botnet, according to The Hacker News↗ (opens in a new tab) and BleepingComputer↗ (opens in a new tab). The affected devices include models sold under the MECOOL brand and others made by Videostrong, a company based in Shenzhen, China. The infection also reached telehealth devices, karaoke machines and digital signage. TrendAI counted 1,472,554 infected devices across 206 models between June and October 2026. The largest numbers were in Malaysia, Brazil, Iraq, Mexico and Taiwan, with tens of thousands in the US, UK, Germany, Australia and Canada.

How the attack worked

Google says it is highly confident that Videostrong intentionally built a backdoor, named x.cpe, into the firmware of its devices and sold access to criminals. Unlike most botnets, which infect devices after sale, this malware was installed during manufacturing. The backdoor runs as a system app with full privileges, reporting to command-and-control servers and waiting for instructions. It can silently install apps, run commands, capture screenshots, record keystrokes, copy account details, and open a remote command line. The criminals used these powers to turn devices into residential proxies (letting others use the owner's internet connection) and to commit ad fraud by faking ad views and clicks. The malware also allowed further infections by other malware families.

The backdoor is persistent. If removed, it reinstalls itself when the device restarts. It disables Google Play Protect, Android's built-in security feature, before installing new software. The malware's control infrastructure used domains like anyevonline[.]com and MQTT brokers to manage infected devices.

The response

Google led a takedown operation in late October 2026, working with Japan's National Police Agency and security firms including Lumen, HUMAN Security, Plume, Synthient and TrendAI. They took down the botnet's command-and-control servers and domains, disrupting operations for more than a dozen malware families. Google also cut all business ties with Videostrong, banning it and any future affiliates from making or supplying certified Android devices.

Google has changed its certification review process after finding that Videostrong hid its malicious code to bypass security checks. The company is now improving its checks of firmware on Android TV devices. However, the backdoor remains on affected devices, and owners cannot remove it themselves. Some security firms recommend a factory reset, but others say the only safe option is to throw the devices away.

What you should do

For consumers, the safest step is to disconnect and dispose of any affected TV boxes, especially those from MECOOL or Videostrong. For organisations, security firms recommend using published indicators to find and remove these devices from networks, blocking related domains and IP addresses, and keeping smart devices on separate network segments. Companies with remote staff should treat unmanaged home devices as part of their attack surface and keep corporate access behind managed equipment.