{
  "id": 17854121,
  "title": "Google Says Videostrong Built a 1.3 Million-Device Android Botnet Into Its Own TV Boxes",
  "url": "https://urgent.news/2026/11/02/google-says-videostrong-built-a-1-3-million-device-android-botnet",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-02T21:04:45.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/etairos/google-says-videostrong-built-a-13-million-device-android-botnet-into-its-own-tv-boxes-57nc"
  },
  "original_language": "en",
  "account": "In October, over a million Android devices, primarily TV set-top boxes, were disconnected from their control servers, marking the takedown of a massive 1.3 million-device Android botnet built by Shenzhen device maker Videostrong. Google, along with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI, took action against the control servers.\n\nThe backdoor, known as x.cpe, was intentionally integrated into Videostrong's devices and sold to criminal buyers. The backdoor allowed operators to install apps, run commands, capture screens, steal account details, and open reverse shells. Criminals used the compromised devices to create residential proxies and ad fraud engines, affecting 206 models across 1,472,554 infected devices. The backdoor also appeared on telehealth devices, karaoke machines, and digital signage, posing a wider threat.\n\nGoogle could not remove the backdoor as it resides in the firmware and reinstalls upon reboot. The only solution is vendor action, platform protection, or device replacement. Google banned Videostrong from certified Android and from supplying software to other certified makers. Google also admitted a process failure in its compatibility and security testing, allowing the malicious payload to bypass and load after the device's first boot. Despite the takedown, more than a million boxes still harbor the backdoor, leaving the issue unresolved.",
  "summary": "TL;DR what: Google, with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, took down the control servers of a 1.3 million-device Android botnet and says Shenzhen device maker Videostrong intentionally built the x.cpe backdoor into its boxes. impact: Operators could silently install apps, run commands, capture screens, steal account details and open reverse…",
  "key_points": [
    "Google takedowns 1.3 million-device Android botnet linked to Videostrong.",
    "Backdoor x.cpe integrated into devices sold to criminals for malicious use.",
    "Google unable to remove backdoor as it resides in firmware, only vendor action can fix."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}