# Android Manufacturer Hijacks 1.3 Million Devices for Botnet Operations Google terminates partnership with Videostrong after discovering intentional malware backdoors in set-top boxes. - **Source:** [The Verge (theverge.com)](https://www.theverge.com) - **Published:** 2026-11-02 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/42b70ff8-0d33-4920-92a0-3c9b62686a2c ## Massive Android Device Compromise Google identified that Shenzhen-based manufacturer Videostrong Technology Co. intentionally embedded backdoors into 1.3 million Android devices. These compromised units, primarily set-top boxes, were transformed into a large-scale botnet. The breach occurred over several years, impacting various hardware models and brands, including telehealth equipment, digital signage, and karaoke machines. ## Intentional Financial Exploitation The manufacturer utilized these backdoors to generate illicit revenue by selling access to criminal affiliates. These third parties deployed secondary malware modules to conduct ad fraud and data exfiltration. By silently enrolling devices into residential proxy networks, the operators successfully monetized the hardware without the knowledge or consent of end users. ## Google's Remediation and Sanctions Google has officially dismantled the backdoor infrastructure and severed all business ties with Videostrong Technology Co. The manufacturer is now strictly banned from producing or selling certified Android devices. Furthermore, the company is prohibited from supplying any software components for the Android ecosystem, effectively ending their role as a hardware partner. ## Disrupting Global Command Networks Beyond the initial 1.3 million devices, Google took action to disrupt command and control domains used by criminal affiliates. These affiliates operated across diversified distribution channels, extending their reach beyond the XCPE-compromised hardware. This intervention successfully severed access to at least 10 million additional compromised devices globally, limiting the broader impact. ## Sophisticated Obfuscation Tactics Videostrong employed advanced obfuscation techniques to bypass standard security checks during the initial manufacturing phase. The malware was designed to activate only after users booted up the hardware for the first time. This delayed execution allowed the malicious code to remain undetected during initial quality assurance and standard device certification processes. ## Evolving Manufacturer Review Processes In response to this security failure, Google has implemented significant changes to its review process for device manufacturers. The incident highlighted vulnerabilities in supply chain integrity that allowed malicious firmware to reach consumers. These new protocols aim to prevent similar intentional hijacking attempts by tightening oversight on third-party software and hardware integration. ## Broader IoT Security Implications The incident underscores the persistent risks associated with Android-based IoT devices, which often lack rigorous security updates. Because these devices are frequently used in sensitive environments like telehealth, the potential for data exfiltration is severe. This case serves as a critical reminder of the dangers posed by compromised supply chain firmware. ## Strategic Shift in Oversight This event marks a turning point for Android ecosystem security, moving toward stricter enforcement of manufacturer compliance. By publicly banning a major partner, Google signals a zero-tolerance policy for intentional firmware manipulation. Future hardware certifications will likely require deeper transparency and more frequent audits to ensure the integrity of the entire Android supply chain. ## Sources covering this story - https://www.theverge.com/1024807/google-botnet-android-tv-shut-down — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._