Google Accuses Chinese Manufacturer of Turning 1.3 Million TV Boxes Into Cybercrime Network

Google has dismantled a massive cybercrime network involving more than 1.3 million Android TV boxes, accusing a Chinese electronics manufacturer of deliberately installing malicious software in devices sold to unsuspecting consumers worldwide.

According to a Nov. 2 investigation by Google’s Threat Intelligence Group, Shenzhen-based Videostrong Technology allegedly embedded a hidden backdoor into its products, allowing criminals to exploit customers’ home internet connections for advertising fraud, unauthorized network traffic, and other illegal activities.

The operation, known as XCPE, affected devices distributed under multiple brands and extended beyond television streaming boxes to other internet-connected products.

Chinese manufacturer accused of deliberately installing malware

Google said its investigators determined with high confidence that Videostrong was responsible for developing and operating the malicious network, which had been active since at least late 2024.

The company allegedly installed malware directly into device firmware, allowing it to survive attempts by users to remove suspicious applications.

For the best of our weekly content！

You are now signed up for our newsletter

Check your email to complete sign up

Google described the operation as having been “intentionally developed, deployed, and operated for financial gain.”

Rather than simply collecting user information, the malware transformed infected devices into components of a commercial cybercrime operation.

According to Google’s investigation, Videostrong sold access to compromised devices to criminal affiliates, which installed additional malicious software to generate fraudulent advertising revenue and route internet traffic through residential connections.

These arrangements, known as residential proxy networks, allow third parties to disguise their online activities by making traffic appear to originate from ordinary households rather than commercial servers.

In some cases, the malware also enabled operators to capture screenshots, execute remote commands, and collect information from infected devices.

Google said the software had been distributed across multiple product models over several years, with sophisticated techniques designed to evade detection.

The company concluded that the operation was “not an isolated rogue insider or a development oversight.”

According to The Record, a cybersecurity publication, Videostrong did not respond to requests for comment about the allegations.

Google cuts ties as millions of devices remain at risk

Following the investigation, Google announced that it had terminated its relationship with Videostrong and prohibited the manufacturer and its affiliates from producing certified Android devices or supplying software to certified manufacturers.

Working alongside Japan’s National Police Agency and cybersecurity companies, including HUMAN Security, Lumen, Synthient, and TrendAI, Google disrupted the infrastructure controlling the infected devices.

The company estimates that the operation could also sever criminal access to at least 10 million additional compromised devices connected to related malware networks.

Robert McArdle, director of cybercrime research at TrendAI, told The Record that millions of households and businesses had their devices exploited by cybercriminals without their knowledge.

The investigation also revealed that the malware had spread beyond conventional television streaming devices.

Researchers identified compromised Android-based telehealth equipment, karaoke machines, and digital signage systems, highlighting the growing security risks associated with the Internet of Things.

Ben Brundage, founder of cybersecurity firm Synthient, warned that the scale of the operation could be substantially larger than currently documented.

“The scale of affected devices is likely way higher,” Brundage told KrebsOnSecurity.

Although the takedown disrupted communications between infected devices and their controllers, the malicious software may still be embedded in their firmware.

Security researchers at Malwarebytes warned that affected consumers should disconnect suspicious devices and contact their manufacturers about obtaining clean firmware or replacements.

Google has also acknowledged weaknesses in its device certification process, explaining that Videostrong used techniques that allowed malicious components to activate after the devices completed their initial startup.

The company said it has strengthened its security review procedures to prevent similar attacks.