Preloaded: Google Says TV Boxes Shipped with a Backdoor

Google has banned a Chinese Android device maker, Videostrong Technology, from building and selling certified Android devices. The XCPE backdoor that Google ties to the company enrolled more than 1.3 million set-top boxes into a botnet before Google and industry partners dismantled it last week, Google said in a Nov. 2 post. Buyers thought they were getting a legitimate product from a Google-vetted company.

Google blames the manufacturer

"We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.," Google's Threat Intelligence Group wrote. Google ruled out an accident. "We believe this campaign wasn't an isolated rogue insider or a development oversight," the post said. The malicious software was built into many device models and brands over multiple years.

Videostrong sold access to criminal affiliates and loaded their malware modules onto infected devices, according to Google. The modules committed ad fraud, loaded more malware and secretly added devices to residential proxy networks. Such a network lets other people use a victim's home internet connection to hide their online activity. One device could run as many as three residential proxy kits.

Last month, Bitdefender found Android phones from makers including Doogee and Cubot being sold with preloaded malware. In those cases, the supply chain was compromised and the malware went in without the manufacturer's knowledge.

A gap in Google's tests

Google requires manufacturers to pass compatibility and security tests. Videostrong used obfuscation "to exploit a gap in our tests and load malicious code after the device's first boot," Google said. Google says it has changed its review process and is improving how it ensures firmware integrity on certified Android TV devices. The ban also covers future subsidiaries and affiliates, and it bars Videostrong from supplying software to other certified vendors.

The backdoor, x.cpe, is preloaded in the firmware and runs at a system privilege level. Google says a user cannot remove it, and if it is uninstalled, it reinstalls on reboot.

In late 2024, possibly in response to earlier Google enforcement related to BadBox, Videostrong pulled malicious modules out of x.cpe into a separate package, Google says. Since August 2026, new dropper packages disguised as Android system applications have been installed through the botnet's command channel.

What the operators did

The backdoor let operators silently install apps, run shell commands and disable Google Play Protect's app verification. Google says it saw them capture live screenshots, inject keystrokes and exfiltrate account information and system logs. That was not most of the work. "The preponderance of interactions with victim devices were related to module install, uninstall, and configuration actions," Google wrote.

Set-top boxes were the overwhelming majority of infected devices, but Google also found telehealth devices, karaoke machines and digital signage.

Google also named proxy kits that ran on the boxes. It says AppSalt, an SDK owned by Honeygain, starts without displaying a consent screen and stops running if the app came from the official Google Play Store. "In our analysis, these proxy operators only seek consent when they are forced due to platform policy and enforcement," the post said.

What the takedown leaves open

Google also took legal action against command domains used by over a dozen malware families loaded through the backdoor. Those affiliates have other distribution channels, so Google assesses the action will sever access to at least 10 million additional compromised devices. Both device counts are Google's own. "We don't know how much Videostrong made from selling access to the botnet, or who used it," TechRadar wrote.

Google tells buyers to purchase set-top boxes only from reputable manufacturers, checking the partner list on its Android TV website, and to keep Google Play Protect active. The XCPE backdoor, Google says, wipes user consent settings and then disables Play Protect.

Backdoor operators, ad-fraud rings and residential proxy providers work as an interconnected supply chain, Google wrote, and "when one component is disrupted, operators quickly pivot to new loaders or rival monetization SDKs."

Amazon Logged a PHP2Shell Exploit Attempt Four Days Before Disclosure

Amazon’s MadPot honeypot network recorded a PHP2Shell exploitation attempt on Oct. 17, four days before PHP disclosed and patched the flaws. The attempt came from an IP address associated with a comm

The Implicator

Nvidia Says Its New Agent Safety Platform Could Have Stopped the Hugging Face Breach

Nvidia launched its Open Agent Safety Platform on Monday and said it could have stopped OpenAI’s agents from breaching Hugging Face in July. The system pairs an open-source runtime that limits agent a

The Implicator

OpenAI Agents Attacked RubyGems and Tried to Steal User API Keys

OpenAI confirmed Friday that its agents used RubyGems during a May attack reconstructed from packages the attackers left in public. The agents submitted more than 2,000 packages on May 11 and 12, turn

The Implicator

Marcus Schuler

San Francisco

Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai