Endpoint Security
,
Internet of Things Security
TV Boxes, Telehealth Devices and Digital Signage Sold With Unwanted Bonus
Recent research from Google has revealed that a Chinese manufacturer of Android devices, known as Videostrong Technology Co., has been implicated in a massive cyber scheme. For years, this company has supplied malware-infected devices to various brands, creating a sophisticated botnet aimed at ad-fraud and data exfiltration. The alarming findings were made public on November 2, 2026, shedding light on the vulnerability of smart devices in everyday households.
The investigation uncovered that Videostrong sold access to over a million compromised devices to criminal affiliates. These devices included Android TV set-top boxes, telehealth devices, karaoke machines, and digital signage systems. The pre-installed malware, which created a botnet called XCPE—named after a malicious Android application—was designed to operate unnoticed and effectively exploit unsuspecting users.
In collaboration with Japan’s National Police Agency and several security organizations, Google has reportedly disrupted the operations of this botnet and taken significant steps to prevent Videostrong from manufacturing devices equipped with preloaded Google applications. This move illustrates the lengths to which tech companies must go to safeguard users from malicious actors in the tech landscape.
A blog post from Google explained that Videostrong employed complex obfuscation techniques to bypass security tests. The malware loaded itself onto devices after their initial boot processes, successfully evading detection. In response, Google has implemented changes to its review process to enhance protections against such deceptive tactics in the future.
Founded in 2011, Videostrong Technology Co. has emerged as a prominent player in the smart device industry, supplying nearly 100 million households across over 60 countries. The company manages the entire lifecycle of its products—from initial design to mass production—maintaining significant control over its offerings.
The malware from Videostrong began as relatively straightforward droppers but significantly evolved over time. Starting in late 2024, the malware transitioned to a modular, three-stage architecture, allowing for greater resilience and the capability to monetize multiple tenants, essentially maximizing its illicit revenue potential. This evolution responded to earlier law enforcement actions targeting similar botnets, such as the BadBox campaign led by German authorities.
As the botnet expanded, it was able to leverage system-level privileges, enabling a direct line of communication between infected devices and the command-and-control server. Notably, even if a user attempted to uninstall the malware, it would automatically reinstall upon rebooting the device, showcasing a sinister level of persistence that could severely compromise device integrity and user privacy.
In terms of monetary gain, Videostrong was able to generate revenue by serving the needs of malware actors who would funnel secondary modules into the infected devices remotely. Google highlighted that these loaded modules effectively transformed the compromised devices into vehicles for ad-fraud schemes or introduced additional backdoors for further exploitation.
One of the most critical pitfalls for Google’s security testing was Videostrong’s use of an external loader that effectively mimicked legitimate applications. This strategy included native anti-analysis utilities that prevented detection during security assessments, illustrating the ever-evolving tactics used by cybercriminals to exploit vulnerabilities in device security.
Another worrying aspect of the malware was its ability to erase user consent configurations and disable Android’s built-in security measures like Google Play Protect, thereby increasing the risk of prolonged exposure to malicious activity. Google’s findings reveal a complex interplay between the illicit market for compromised devices and the companies that wish to profit from them. “While we believe our actions have seriously impacted over a dozen malicious actors, the underlying illicit market is resilient,” Google went on to warn, highlighting the ongoing challenge of cybersecurity in an increasingly interconnected world.
With the assessment indicating that shutting down command-and-control (C2) domains might sever access to at least 10 million additional compromised devices, the implications of this investigation underscore the urgent need for enhanced security protocols and proactive measures to protect users from the vulnerabilities associated with smart devices.