Chinese manufacturer installed backdoor in Android TV devices

A Chinese company named Videostrong, known for manufacturing set-top boxes under the MECOOL brand, secretly embedded a backdoor into Android TV devices it produced for multiple brands. This allowed cybercriminals to access over 1.3 million devices.

Google and authorities dismantled the network

In collaboration with the Japanese National Police Agency and five cybersecurity firms, Google removed the compromised network last week. The company stated that the backdoor was not the result of an isolated employee or a simple mistake but a deliberate effort.

Researchers traced backdoor to Videostrong

Security experts from Synthient traced the backdoor to Videostrong by examining a MECOOL KM9PRO Max set-top box purchased in late 2025. They found a document on a pirate server written by Videostrong’s R&D director, linking the company directly to the attack.

Backdoor was embedded in firmware with system privileges

Videostrong embedded its backdoor, named x.cpe, into a partition of the firmware with full Android system privileges. The backdoor was programmed to reinstall itself if users attempted to delete it, ensuring persistent access to the devices.

Hackers used infected devices to install criminal modules

Once a device was powered on, hackers gained control through their command servers. They installed applications, disabled Google Play Protect, and executed commands with system-level rights. They also stole live screenshots and account information, but primarily used the devices to install modules for criminal clients.

Modules used residential proxy networks

The modules installed on the devices were often sourced from residential proxy providers like Linkfog and NetNut. These companies route internet traffic through home connections without the users’ knowledge, allowing hackers to use the devices for fraudulent activities.

Hackers exploited devices for ad fraud and other crimes

In some cases, hackers installed three different modules on a single device to maximize its use. They also loaded invisible web pages on televisions and clicked on ads in place of users. Two of the backdoors used were previously linked to the BadBox 2.0 botnet.

Google removed Videostrong from Android certification

To sell Android TV devices with Google apps, manufacturers must pass compatibility and security tests. Videostrong bypassed these by hiding malicious code and loading it after the first boot. Google has since updated its review process and removed Videostrong from Android certification.

Videostrong evolved its malicious methods over time

In late 2024, Videostrong moved its malicious modules into a new application called com.abc.nexus. By August 2026, it replaced this with small apps disguised as Android system components. Google claims this was an intentional effort to avoid detection.

Google severed ties with Videostrong permanently

Google has ended its relationship with Videostrong and revoked its right to produce Android TV devices with its software. It also bans Videostrong and its future subsidiaries from manufacturing certified devices or providing software to other manufacturers.

Backdoor remains in sold devices, requiring user action to remove

Although Google disconnected the devices from command servers, it could not remove the x.cpe backdoor from already sold devices. Users must manually install a clean firmware or disconnect the device from the internet to eliminate the threat.

Google warns against suspicious apps and untrusted manufacturers

Google advises users to avoid apps that offer payment for unused bandwidth, as these can recruit devices into proxy networks. It also recommends purchasing set-top boxes only from manufacturers on its Android TV partner list.