Google said that these malicious codes were not errors in the software development process but were intentionally installed by the manufacturer on these devices.

Instead of having to find a way to infiltrate from the outside, this time cybercriminals have control over millions of devices right from the factory. Notably, the manufacturer behind these TV Boxes silently installed backdoors into the products, then sold access rights to criminal groups. Devices that have been certified by Google for Android TV thus become a network serving fraud and attacks on the Internet.

The company discovered is Videostrong Technology, an electronics manufacturer headquartered in Shenzhen, China. This used to be a Google certified partner in the Android TV ecosystem. However, Google's investigation discovered that Videostrong actively installed malware into the firmware of more than 1.3 million devices, mostly TV Boxes running Android TV and Google TV.

Unlike regular malware infections, users do not need to download a suspicious application or access a dangerous link. The backdoor has been integrated right into the production process, before the device reaches the customer. Videostrong then sells access to these devices to cybercriminal groups, and also helps download third-party malicious code modules to the devices.

Once controlled, TV Box can be turned into a tool for many illegal activities. Attackers can install additional applications without the user's knowledge, execute commands remotely, collect device and account information, and even survey the home's internal network. Some functions also allow taking screenshots, recording keystrokes and disabling the Google Play Protect application verification mechanism.

More worryingly, these TV Boxes can be turned into a link in the residential proxy network. At that time, the user's home Internet IP address is used as a traffic transfer point for cybercriminal activities. The device owner may not know that the family's Internet connection is being used for illegal purposes.

Google said this was not an individual employee's behavior or a mistake in the software development process. The malicious code system is maintained for many years, comes with its own server infrastructure and constantly changing configurations to avoid detection. Since late 2024, the malware has evolved into a three-stage architecture, allowing for flexible deployment of various modules.

To bypass the certification process, Videostrong uses a notable trick: malicious code is pre-installed in the firmware but only downloads or activates dangerous components after the user first turns on the device. Thanks to this, the product can pass compatibility and safety tests before being certified. This vulnerability also caused Google to admit that its device evaluation process was not strict enough.

Another problem is that the backdoor is difficult to remove using normal means. The malicious component is placed in the system partition and operates with elevated Android permissions. Even if the user removes it as an app, the malicious code can reinstall itself after the device restarts.

Faced with the scale of the incident, Google ended its partnership with Videostrong, revoked its certification partner status, and banned the company and its affiliates from manufacturing Android devices pre-installed with Google apps or providing software to certified manufacturers. Google also took legal measures to disable the domains and servers that control the XCPE botnet.

However, taking down the control server does not mean the malicious code has been removed from the entire device. This measure essentially cuts off communication between the attacker and the infected machines, thereby preventing them from continuing to receive commands remotely. Google said the campaign also helped block communications of at least 10 million other devices with attackers, belonging to other malware families.

The incident exposes a worrying paradox in the smart device ecosystem: users can buy a product with official certification, but that doesn't mean the manufacturer behind it is always trustworthy. In Videostrong's case, the danger does not come from an app that the user accidentally installed, but from the software itself that was included on the device by the manufacturer in the first place.