Google says Videostrong built a hidden backdoor into its Android TV boxes on purpose. The takedown hit 1.3 million devices, and owners cannot fix the boxes themselves.
Google says a Chinese maker of TV boxes built a hidden backdoor into its devices on purpose and sold access to criminals. In late October, a takedown led by Google cut a botnet of more than 1.3 million Android devices off from its control servers. A botnet is a network of hijacked devices that criminals run from afar. Most of these were TV set-top boxes.
Google says it is highly confident that Videostrong, based in Shenzhen, China, put the backdoor, called x.cpe, into many device models and brands over several years. It does not believe a rogue employee or a mistake was to blame. Videostrong makes Android TV boxes under its own name and for other brands. Google has banned the company from building or selling certified Android devices.
The backdoor could install apps silently, run commands, capture the screen and map the home network. To stay hidden, it first switched off app checks in Google Play Protect, Android's built-in security feature. Google says it saw operators take live screenshots and copy out account details.
Most of the add-on programs turned boxes into residential proxies. That means strangers paid to send their internet traffic through an ordinary household connection. Other programs faked views of online ads.
Security firm TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1, and says the true number is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The U.S., Germany, the U.K., Australia and Canada each had about 26,000 to 42,000. Besides TV boxes, the backdoor turned up on:
The backdoor is part of the firmware, the software built into the box, so it reinstalls itself when the box restarts. Owners cannot remove it themselves. Synthient has published a list of 182 model names seen in the campaign. A model name alone does not prove a box is infected. Synthient bought a MECOOL KM9PRO Max and found the backdoor already installed.
Plume recommends a full factory reset but does not say whether that removes x.cpe itself. Synthient tells consumers to throw the boxes away for good. TrendAI advises companies with remote staff to keep corporate access behind managed devices, not unmanaged home gear.
Google expects the action to cut criminals off from at least 10 million more infected devices, but it warns they switch to new tools quickly. Plume says the botnet included both Google-certified devices and ones running the open-source version of Android. Google's report does not say how many certified devices were hit. As of November 2, Videostrong's website still listed products it calls Google Certified. Google says it has changed its review process and is improving firmware checks.
If you own a cheap Android TV box, check it against Synthient's model list, and consider replacing it if it matches, since a reset may not remove the backdoor.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA fake call in Truro, Canada, sent a police tactical team to a woman's home. An RCMP officer now shares plain rules for spotting phone scams.
Read more: Canadian police share simple rules to beat phone scammersKMBC 9 News has launched Scam School, a series on spotting the warning signs of scam texts and calls so you can protect your money and your family.
Read more: A local TV series shows the warning signs of phone and text scams
