Google cuts ties with Android TV manufacturer Videostrong after taking down a massive malware botnet

Google and industry partners have disrupted the XCPE botnet, an operation that turned over 1.3 million streaming TV boxes into a cybercrime network. The company attributes the scheme to Chinese hardware manufacturer Videostrong Technology Co., which produces budget devices sold under the MECOOL brand on platforms like Amazon and AliExpress. Google says the maker intentionally embedded backdoors directly into device firmware during manufacturing to generate illicit revenue. [3][5]

Running with system-level privileges, the main backdoor could disable Google Play Protect, secretly install additional applications, execute shell commands, and harvest sensitive account logs. Affiliates purchased access to the backdoored hardware to run ad fraud schemes, deploy secondary backdoors, and route third-party traffic through infected hardware as residential proxies. Cybersecurity firm Synthient traced the infrastructure back to Videostrong after finding the backdoor preinstalled on a MECOOL KM9PRO Max unit, noting that users must disconnect devices from the internet or flash clean firmware to eliminate the infection. [3][5]

The international disruption effort involved Japan's National Police Agency alongside cybersecurity firms including Lumen, HUMAN Security, Plume, Synthient, and TrendAI. As part of the takedown, command-and-control servers were seized, severing access to at least 10 million additional compromised devices across various hardware types. Google has terminated its partnership with Videostrong, revoked its licenses, and barred the manufacturer and its future affiliates from producing certified Android hardware or supplying code to certified vendors. [3][5]