Endpoint Security
,
Internet of Things Security
TV Boxes, Telehealth Devices and Digital Signage Sold With Unwanted Bonus
Tiffany Wang •
November 2, 2026
Image: Shutterstock
An Android device manufacturer based in China supplied malware-laced devices to many brands over the years and created a botnet for ad-fraud and data exfiltration, Google researchers said Monday.
See Also: Building Cyber Resilience in the Water Sector
The company, Videostrong Technology Co., sold criminal affiliates access to more than a million compromised devices and installed their malware, primarily on Android TV set-top boxes but also on IoT devices such as telehealth equipment, karaoke machines and digital signage systems. The firm’s pre-implanted backdoor established a botnet known as XCPE, named after a malicious Android application.
Google said it has disrupted the botnet with Japan’s National Police Agency and other security organizations and banned Videostrong from making devices with preloaded Google applications.
“Videostrong employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device’s first boot,” Google said in a blog. “As a result, Google has implemented changes to its existing review process to better safeguard against similar activity in the future.”
Founded in 2011, Videostrong serves nearly 100 million households in over 60 countries and regions with intelligent hardware products, according to its website. The company takes care of the entire production process, from product design to large-scale production.
Videostrong’s pre-installed malware began as single-stage droppers that contained malicious payload within its own binary, Google said. From at least late 2024, it evolved into a modular, three-stage architecture designed for resilience and multi-tenant monetization.
The shift followed German authorities’ disruption of BadBox, another botnet campaign targeting Android TV devices, in 2024. Months later, U.S. organizations dismantled its successor, BadBox 2.0, compromised of more than 10 million uncertified Android devices.
Videostrong’s malware ran with system-level privileges, enabling communication between the command-and-control server and the components responsible for loading and executing malicious code. If uninstalled by a user, it automatically came back from the firmware upon reboot.
The Chinese firm monetized the botnet to funnel malware actors’ secondary modules into the infected devices from remote hosts.
“The loaded modules transform infected devices into residential proxy exit nodes (e.g. Linkfog, AppSalt, NetNut), ad-fraud engines (e.g. CBOXTV, HiddenView), or execute additional backdoors that load even more monetization modules (e.g. Moyu, Spirit),” Google said.
Videostrong was able to evade Google’s security tests for hardware suppliers because its primary backdoor worked with an external loader that had native anti-analysis utilities to thwart sandbox detection, Google said.
The malware also wiped user consent configuration on the device and then disabled Android’s built-in malware protection tool Google Play Protect.
“While we believe our actions have seriously impacted over a dozen malicious actors, the underlying illicit market is resilient,” Google warned. Videostrong’s clients run their own diversified distribution channels. “We assess that taking down their C2 domains will sever access to at least 10 million additional compromised devices,” it said.