Google Bans Chinese Android Manufacturer Over Malware Found on 1.3 Million Devices

Google has accused Android partner Videostrong Technology of embedding malware in more than 1.3 million Android-based devices.

How Was the Malware Installed?

Google said Shenzhen-based manufacturer Videostrong Technology deliberately embedded a malicious backdoor into Android devices during manufacturing, allowing attackers to gain access before the products reached consumers. The company, which operated as an Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM), developed devices for other brands alongside its own products. It became an Android partner in 2011.

According to Google, the malware campaign was intentionally developed and operated for financial gain rather than resulting from an isolated employee’s actions or a software development error. Google has consequently barred Videostrong from manufacturing or selling certified Android devices and supplying software for them.

https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/

What Could the Malware Do?

The malicious backdoor, identified as x.cpe, was embedded in device firmware at the factory. Once an affected device was switched on, the malware obtained system-level access without the owner’s knowledge. This access allowed attackers to install applications silently, execute commands, capture screenshots and collect account credentials and device information. The infected devices were also converted into residential proxies, enabling criminals to route internet traffic through users’ home connections without their consent.

Google said the resulting botnet supported advertising fraud, data theft, unauthorised internet traffic and the installation of additional malware. Criminal affiliates could reportedly access infected devices and their internet connections through the network.

Which Devices Were Affected?

Most affected products were Android TV set-top boxes, although the malware was also identified in telehealth devices, karaoke machines and digital signage systems. The campaign extended across more than 200 countries, affecting several brands and models over multiple years. Google did not identify specific affected products.

Videostrong’s website claims its products serve more than 100 million households across over 60 countries, although this figure does not represent the number of infected devices.

The scale of the campaign raised concerns about malware being installed during manufacturing, leaving consumers exposed without knowingly downloading malicious applications.

What Action Has Google Taken?

Google said it worked with Japan’s National Police Agency and cybersecurity companies Lumen, HUMAN Security, Plume, Synthetient and TrendAI to disrupt the botnet. The operation targeted the infrastructure supporting the malware, including command-and-control domains and servers used to manage infected devices.

Google also initiated legal action to shut down the infrastructure and said its partners disrupted more than a dozen malware-related domain families. The company estimates that these measures will prevent criminals from accessing at least 10 million additional compromised devices distributed through channels outside the x.cpe network. Google has also strengthened its review procedures and firmware integrity checks for certified Android TV devices.

Although the botnet’s infrastructure has been disrupted, the precise list of affected devices remains undisclosed, leaving uncertainty about which products originally contained the malware.

Google has advised consumers to purchase connected devices, including set-top boxes, from reputable manufacturers. The case follows earlier Android botnet incidents, including BadBox and Vo1d, which reportedly affected millions of connected devices.