Google Disrupts 1.3 Million-Device Android Botnet After TV Box Maker Videostrong Found Selling Criminal Backdoor Access

Affiliate disclosure: We may earn a commission from qualifying purchases through these links at no additional cost to you. As an Amazon Associate I earn from qualifying purchases.

Google has disrupted a botnet that researchers say spanned more than 1.3 million Android devices, with the bulk of the infected hardware made up of TV set-top boxes, according to findings reported by The Hacker News on 2026-11-02.

What Google says happened

Google concluded that Shenzhen-based Videostrong intentionally embedded a firmware-level backdoor called x.cpe and then sold access to it to cybercriminals, The Hacker News reported on 2026-11-02. Google also said it severed ties with Videostrong and banned the company from producing or supplying software for certified Android devices.

The backdoor reportedly granted system-level access, which operators could use for ad fraud, screen capture, keystroke recording, reverse shells, and turning compromised devices into residential proxies for routing malicious traffic, according to the same report.

Why the botnet was hard to clean up

Because the code was embedded in firmware, it reportedly survived reboots. The Hacker News said researchers believe replacing the device may be the only reliable fix. That makes this case more difficult than a standard malware cleanup, since a simple reset would not necessarily remove the threat if the firmware itself remains compromised.

Scope of the exposure

The reported backdoor was found across more than 206 device models, including telehealth devices, karaoke machines, digital signage, and TV set-top boxes, The Hacker News reported on 2026-11-02. The article also said the botnet had lost control of its servers in late October, and that Google’s takedown successfully disrupted the operation.

What is clear, and what is not

What appears clear from the published findings is that Google attributes the infrastructure and access model to a deliberate firmware backdoor, not just opportunistic malware infection. What remains less clear from the source material is the full extent of each device’s compromise or how many individual victims were affected beyond the reported botnet size.

For users and buyers, the practical takeaway is that firmware-level trust matters as much as app-level security. Devices that run Android or Android-derived software can be exposed to abuse if the underlying system software is compromised at the manufacturer level.

Bottom line

This takedown shows how a supply-chain or firmware compromise can turn ordinary consumer and commercial hardware into a large-scale abuse network. Based on the findings reported by The Hacker News on 2026-11-02, the biggest concern is not just the botnet itself, but the difficulty of fully cleaning devices when the backdoor lives in firmware rather than in a removable app or service.

Sources and dates

Research completed: 2026-11-03T05:09:00+00:00

Building your own website?

This separate resource is for readers creating an online business: Explore Systeme.io. It is an affiliate link, not an Amazon product recommendation.