Google Cuts Android TV Box Backdoor Access
Google blocks a botnet's control servers after a manufacturer's backdoor ran in many certified devices for years.
Updated on Nov. 2, 2026 in Cybersecurity
Live Poll
Do you trust streaming box makers to keep malware off their devices?
Google has cut ties with Videostrong, a manufacturer of certified Android TV boxes, after finding it built a backdoor into those devices that it could sell access to. Google also took legal action to block the domains and servers used to control the XCPE botnet. The development is an enforcement action and takedown, not an announced product.
Why it matters
The case shows how a backdoor can ride inside certified consumer hardware and slip past platform testing, since Videostrong used obfuscation to exploit a gap in Google's tests. It points to a trajectory where platform vendors must police the software supply chain of their partners, not just their own code.
Google's takedown is measured in devices rather than code: at least 10 million compromised devices are severed from the XCPE botnet's control servers. The number reflects additional devices beyond those already identified, though the stub does not provide a baseline total for comparison.
The players
Google, the maker of the Android operating system, certifies third-party Android devices and runs the review process that Videostrong's obfuscated code evaded.
Videostrong
Videostrong is a manufacturer of certified Android TV boxes whose devices carried a backdoor it could sell access to.
Synthient
Synthient compiled a list of potentially affected devices, focused on the Mecool brand.
The details
Videostrong built a backdoor into certified Android TV boxes, a class of set-top devices that run Google's Android operating system, and sold access to it, including the distribution of malware. The malicious code was not present at first boot; bad actors used obfuscation, meaning deliberately disguised code, to load the payload after the device was first switched on, which is how it evaded Google's review tests. Google responded by banning Videostrong and its subsidiaries from selling certified Android devices and from supplying software to other certified vendors.
Timeline
November 2, 2026: Google announces it is cutting ties with Videostrong in a post.
The Tech Race
Google's enforcement against Videostrong sits within the contest among platform owners to secure the Android TV ecosystem against third-party hardware risk. Google's updated review process is its response to a gap that let obfuscated malware pass certification.
Owners of certified Android TV boxes, particularly Mecool-brand devices on Synthient's list, should expect their devices to lose access to the XCPE botnet's control servers as the domains are blocked. The stub does not say whether affected devices will receive a software fix or replacement, and Mecool has been rumored to be shutting down.
The takeaway
Watch whether Google's updated review process catches obfuscated payloads that load after first boot in future certification cycles. Watch also whether Mecool's rumored shutdown affects device support for the Synthient-listed models.
Further reading
For broader context on how device backdoors and botnets are tracked, see the Cybersecurity coverage.
Source note: This article includes information reported by 9to5Google.
Live Poll
Do you trust streaming box makers to keep malware off their devices?
