Google Bans Partner Videostrong Over Firmware Backdoor in Streaming Gear

A multinational tech coalition severed command servers for the illicit residential proxy network, but permanent firmware modifications prevent owners from safely resetting infected living-room appliances.

Google announced Monday that it collaborated with cybersecurity industry partners to dismantle a sprawling botnet that secretly conscripted more than 1.3 million Android TV streaming devices into an illicit commercial proxy network.

The tech giant permanently severed all commercial partnerships with Shenzhen-based hardware manufacturer Videostrong Technology Co., after investigators concluded the enterprise deliberately preloaded malicious backdoor software into consumer devices at the factory level. Google banned Videostrong, its corporate affiliates, and future subsidiaries from producing certified Android hardware or supplying system software to other licensed device makers.

A technical investigation published by the Google Threat Intelligence Group revealed that Videostrong spent years engineering and distributing the malicious infrastructure across diverse consumer brands for direct corporate gain. The backdoor code, designated internally as XCPE, operated under system package identities such as x.cpe and com.oemservice, securing root-level operational privileges on consumer hardware.

Investigators found that the takedown neutralized command-and-control servers linked to over a dozen affiliated cybercrime operations, cutting malicious access to an estimated 10 million additional compromised devices worldwide. Those secondary targets spanned an array of internet-connected hardware, including Android-powered telehealth monitors, commercial digital signage, and connected karaoke units.

Videostrong maintained standing certification agreements with Google, allowing its hardware to ship with legitimate Google Play services and official branding. To slip past rigorous compatibility and security evaluations, the manufacturer concealed the backdoor within the protected OEM system partition of the device firmware.

The malicious modules remained inert during factory quality evaluations and Google compliance scans. Using layered obfuscation, the software triggered only after a retail customer connected the set-top unit to the internet and completed the initial device boot sequence.

Once activated, the XCPE component quietly wiped user privacy settings, systematically disabled the automated verification routines of Google Play Protect, and established persistent communication with remote command servers. With platform defenses deactivated, the backdoor fetched external software packages disguised as benign operating system components. In late 2024, Videostrong restructured its architecture by decoupling malicious payloads into external dropper packages to evade security signatures, deploying new disguised Android applications as recently as August 2026.

The primary financial engine behind the scheme involved converting home internet connections into residential proxy relays. Videostrong leased consumer network bandwidth to commercial proxy operations, including modules associated with services like AppSalt and Honeygain. Cybercriminals routinely purchase access to residential proxy networks to route credential-stuffing attacks, click fraud, and automated scraping through legitimate residential Internet Protocol addresses, masking their origin from enterprise security filters.

Compromised streaming boxes frequently hosted up to three competing proxy kits simultaneously. Beyond reselling household bandwidth, secondary payloads executed automated digital advertising fraud, captured user keystrokes, recorded display screenshots, and provided unauthorized third parties with interactive remote command shells.

While multinational coordination neutralized the external domain names and servers directing the botnet, the physical devices in consumer living rooms remain fundamentally compromised. Threat researchers participating in the intervention noted that the 1.3 million device figure represents a conservative baseline, with the broader footprint of backdoored hardware extending substantially further across global distribution channels.

Because Videostrong baked the malicious code directly into the read-only flash partitions of the hardware, the backdoor resists conventional consumer troubleshooting. If an owner attempts to delete the rogue services or initiates a standard factory reset, the operating system reinstalls the malicious files directly from the firmware partition upon reboot.

Google emphasized that the campaign was not the result of an external supply-chain breach or a rogue employee, but an intentional, multi-year operation orchestrated by device leadership. Security researchers noted that while cheap off-brand media players frequently harbor malicious software, the direct involvement of an authorized Google manufacturing partner marks a severe escalation in hardware supply-chain risk.

Google stated that it has overhauled its hardware verification protocols, introducing rigorous runtime checks and continuous firmware integrity validation to detect delayed code execution on certified devices. The company advised consumers to audit their living-room electronics against the official Android TV partner registry.

Independent cybersecurity researchers underscored that because the disgraced manufacturer cannot be relied upon to issue clean over-the-air firmware repairs, consumers using affected streaming hardware should immediately disconnect devices from home Wi-Fi networks and replace them with trusted streaming gear.

Source:

Google Cloud Blog November 2, 2026

KrebsOnSecurity November 3, 2026

BleepingComputer November 3, 2026

Malwarebytes November 3, 2026