Google Cuts Ties With Android Partner That Turned 1.3 Million Set-Top Boxes Into a Botnet
Google says Videostrong embedded a backdoor in 1.3 million Android devices, selling access to affiliates for ad fraud, data exfiltration, and residential proxy networks. In November 2026, Google banned the Shenzhen company from certified Android hardware and software.
Google has revealed that one of its Android manufacturing partners secretly installed a backdoor in 1.3 million devices and used them to run a botnet. The company announced in November 2026 that it has since dismantled the backdoor and severed its relationship with the manufacturer: Shenzhen, China-based Videostrong Technology Co.
Videostrong has been banned from building or selling certified Android devices and from supplying software for them. Google says the backdoor and botnet were “intentionally developed, deployed, and operated for financial gain,” with Videostrong monetizing access by selling it to criminal affiliates who loaded malware modules onto infected devices.
Those modules were used for ad fraud, data exfiltration, and routing unauthorized network traffic through infected devices — all without owners’ knowledge. Affiliates also silently enrolled devices into residential proxy networks and loaded additional malware onto compromised hardware.
The affected devices were primarily Android TV set-top boxes, but the malware was also found on other Android-based IoT devices, including telehealth devices, karaoke machines, and digital signage devices. The malware was built “directly into many different device models and brands over multiple years,” according to Google, and was loaded onto devices using obfuscation techniques triggered at first boot.
Google also took action to disrupt the command-and-control domains used by Videostrong’s criminal affiliates. Because those affiliates operate distribution channels beyond the compromised devices, Google says dismantling the domains could sever access to “at least 10 million additional compromised devices.”
Following the incident, Google says it has made changes to its review process for device manufacturers. The scale of the operation — spanning millions of devices across multiple product categories — suggests the compromise may have gone undetected for an extended period before Google intervened.