# Android Manufacturer Hijacks 1.3 Million Devices for Botnet Operations Google terminates partnership with Videostrong after discovering intentional malware backdoors in set-top boxes. - **Source:** [The Verge](https://www.theverge.com) - **Published:** 2026-11-02 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/125863f1-406b-4ddd-9c3c-df9ef015c5ba ## Unauthorized Botnet Discovery Google identified that Shenzhen-based manufacturer Videostrong Technology Co. intentionally embedded backdoors into 1.3 million Android devices. These set-top boxes were secretly converted into a massive botnet without user knowledge. The company has since dismantled the backdoor infrastructure and officially terminated all business ties with the manufacturer to prevent further security compromises. ## Financial Motives Behind Malware The investigation revealed that Videostrong monetized these backdoors by selling access to criminal affiliates. These third parties loaded secondary malware modules onto the infected hardware to conduct ad fraud and data exfiltration. The operation was specifically designed for financial gain, leveraging the compromised devices as nodes within residential proxy networks for illicit traffic. ## Scope of Device Infection The malware was not limited to a single product line but was built directly into various device models over several years. While Android TV set-top boxes represent the majority of infected units, the botnet also compromised telehealth devices, karaoke machines, and digital signage. This widespread integration highlights significant vulnerabilities in the hardware supply chain. ## Disrupting Command and Control Google took decisive action to disrupt the command and control domains used by these criminal affiliates. By severing these connections, the company effectively blocked access to at least 10 million additional compromised devices globally. This intervention targets the diversified distribution channels used by affiliates to maintain control over infected hardware beyond the initial XCPE-compromised units. ## Sophisticated Obfuscation Techniques Videostrong employed advanced obfuscation techniques to ensure the malware remained hidden from users. The malicious code was designed to load onto devices only after the hardware was booted up for the first time. This delayed activation strategy allowed the manufacturer to bypass initial security checks and maintain persistence on consumer devices for extended periods. ## Regulatory and Partnership Consequences Following the discovery, Google has banned Videostrong from building or selling any certified Android devices. The manufacturer is also prohibited from supplying software for the Android ecosystem moving forward. This permanent exclusion serves as a strict enforcement measure against partners who violate the integrity of the platform and compromise user security for profit. ## Revised Manufacturer Review Process In response to this incident, Google has implemented significant changes to its review process for device manufacturers. These updates aim to strengthen oversight and prevent similar supply chain attacks in the future. The company is now applying more rigorous scrutiny to the firmware and software components provided by third-party partners during the certification phase. ## Broader Security Implications This incident underscores the critical risks associated with trust in hardware manufacturing supply chains. When a partner intentionally embeds malware, it creates systemic vulnerabilities that are difficult for end-users to detect or mitigate. Moving forward, platform owners must prioritize deeper transparency and continuous monitoring of third-party firmware to protect the integrity of IoT ecosystems. ## Sources covering this story - https://www.theverge.com/1024807/google-botnet-android-tv-shut-down — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._