Google dismantles 1.3-million-device Android botnet: Videostrong banned from certification
Google has taken legal action to seize the command-and-control infrastructure behind x.cpe, a backdoor preloaded into Android firmware that TrendAI counted on 1,472,554 devices between June 3 and October 1, 2026. The tally covers 206 device models, most of them Android TV set-top boxes, and Google describes it as a floor rather than a ceiling. The company said in its own write-up that cutting off the botnet's affiliate servers should also sever access to at least 10 million further compromised devices, because the same criminal groups distribute malware through other channels.
What the backdoor could do
x.cpe, also tracked as com.oemservice, runs as a system app with android.uid.system privileges. It is baked into the firmware image rather than installed later, so a factory reset does not remove it: the package is restored from the /oem/ partition on reboot. According to Google's threat intelligence team, the implant disables Play Protect app verification by setting package_verifier_user_consent to -1, then opens a persistent MQTT channel to its operators. TrendAI's analysis, summarised by The Hacker News, describes a two-stage design in which an HTTP bootstrap request hands the device its command server.- Silent installation and removal of apps
- Arbitrary shell command execution, including reverse shells
- Screen capture and keystroke injection
- Collection of account details, installed app lists and system logs
- Network reconnaissance of the local subnet
- Reinstallation after reboot from the firmware partition
Residential proxies were the product
Most of the monetisation modules turned infected hardware into residential proxy exit nodes or sold spare bandwidth. Google's report names proxy SDKs including Linkfog, Jaguar, AppSalt, BWM, GaGaNode, NetNut and Traffmonetizer, and notes that a single device could run as many as three of them at once. Other modules, tracked as Spirit, Moyu, Bird, Fission and HiddenView, generated fake ad impressions. A residential proxy network is only as valuable as the diversity and reputation of its exit IPs, and consumer devices in homes provide exactly that: addresses that look like ordinary broadband subscribers rather than data-centre ranges. Buyers of such capacity use it to route scraping, credential-stuffing and fraud traffic that would otherwise be blocked. When the exit node is a television box in someone's front room, the traffic is attributed to that household's connection.A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users. - GoogleFor anyone who treats network identity as an operational concern, the lesson is that a compromised appliance can put traffic on your line that you did not generate. The same reasoning applies to the hardware you use to reach Tor or to manage anything sensitive; we covered the general checklist in our guide to device security before Tor.
Attribution: a signed document and a shared IP
Google says it is highly confident that Shenzhen-based Videostrong Technology built, deployed and operated the backdoor deliberately, and sold access to criminal affiliates. Evidence includes a document signed by Videostrong's R&D director found on a botnet server, a Videostrong domain resolving to the same IP as the operators' control panel, a GitHub account named yf-videostrong used to stage releases, and x.cpe passing command-server settings to other Videostrong apps such as YokaTV Player. Google's Charley Snyder told CyberScoop that operators constantly changed configurations to evade pre- and post-launch detection. Synthient, one of the partners in the disruption, reached the same conclusion independently. It bought a MECOOL KM9PRO Max retail unit and found the backdoor preinstalled, then published a list of 182 device model names observed in the campaign, with the caveat that a model name alone does not prove a given unit is infected. Plume, which supplies router and device management software, found more than a dozen device types talking to the botnet's control server, mostly MECOOL-branded.The takedown, and what it leaves behind
The enforcement, carried out with Japan's National Police Agency and supported by Lumen, HUMAN Security, Plume, Synthient and TrendAI, took down Videostrong's control domains and servers as well as command-and-control domains used by more than a dozen malware families loaded through the backdoor. Google also banned Videostrong and future subsidiaries from building or selling certified Android devices or supplying software to other certified manufacturers. The Register reports that the company has cut ties with the vendor; Videostrong did not respond to requests for comment. Google says it has tightened firmware integrity verification for certified Android TV devices and changed its review process, but the structural problem remains. Certification tests a device before it ships; the malicious code was loaded after first boot, which is precisely the window those tests do not cover. Devices already in the field keep the implant until the firmware is replaced, and TrendAI's position is that remediation requires vendor action, platform protection or replacement of the hardware.Practical steps for owners and buyers
- Treat any model on Synthient's published list as high risk; isolate it from trusted networks or replace it.
- Block the documented bootstrap and MQTT domains at the router or DNS resolver.
- Put smart TVs, boxes and appliances on a separate VLAN or guest network with no route to management interfaces.
- Be sceptical of apps that pay for unused bandwidth or sharing your internet; Google names silent, consent-free enrolment as the most common route into proxy networks.
- Keep Play Protect enabled, and prefer devices from manufacturers on the Android TV certified partners list.