Google says the backdoor was not an accident, a compromised build server or a rogue insider. In a threat-intelligence report published Monday, the company says it assesses with high confidence that Videostrong Technology Co., the Shenzhen manufacturer behind MECOOL-branded TV boxes, built, deployed and operated the implant itself — and made money renting access to criminals.

The malware, tracked as x.cpe, was never downloaded onto the boxes. It shipped inside the firmware, ran as a system app signed with the manufacturer's own key, and waited for orders from a command-and-control server. Before installing anything, it switched off the app checks in Google Play Protect. From there the operators could push apps without the owner noticing, run commands, take live screenshots, send keystrokes, pull account details, device information, app lists and system logs, open reverse shells, and map the network the box sits on.

Most of what the buyers did with that access was quiet and commercial. Modules enrolled the boxes in residential proxy networks — selling a household's internet connection so someone else's traffic appears to come from an ordinary home — or faked views of online ads. Google says Videostrong monetised the backdoor by selling access to criminal affiliates and loading their modules onto infected devices.

The scale

TrendAI, Trend Micro's enterprise unit, counted 1,472,554 infected devices across 206 models between 3 June and 1 October, and says the real figure is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most infections; the United States, Germany, the United Kingdom, Australia and Canada each had roughly 26,000 to 42,000. Most were Android TV set-top boxes, but the backdoor also turned up on telehealth devices, karaoke machines and digital signage. Synthient, which tracks proxy networks, published a list of 182 model names seen in the campaign, while warning that a model name alone does not prove a box is infected.

Google took down the command-and-control domains through legal action, with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI assisting. Because the same affiliates distribute their malware through other channels too, Google estimates the takedown severed access to at least 10 million additional compromised devices.

The part owners can't fix

Because x.cpe is part of the firmware and signed with the vendor's key, uninstalling it does not stick: it returns on reboot. TrendAI says cleanup needs "vendor action, platform protection or replacement of the device." Plume recommends a full factory reset because the affiliate modules may have dropped further backdoors, but does not say whether a reset removes x.cpe itself. Synthient goes further and tells consumers to throw the boxes away.

Google has cut ties with Videostrong and banned the company — plus any future subsidiaries or affiliates — from building or selling certified Android devices or supplying software to other certified device makers. As of Monday, Videostrong's own website was still advertising "Google Certified Android TV Box" and "Google Certified Android TV Stick" products.

How it got past certification

Every certified Android device goes through compatibility and security testing. Google says Videostrong hid its code to exploit a gap in that process, then loaded the malicious payload after the device's first boot — so the unit that was tested was not the unit that shipped to customers. Google says it has changed its review process and is tightening firmware checks on certified Android TV hardware. It has not said how many of the infected devices carried certification, and Plume says the botnet included both certified devices and uncertified ones running the open-source AOSP build.

The comparison that stings: when Google sued over the BadBox 2.0 botnet in July 2025, the 10 million-plus devices involved were uncertified. This time the supply chain carried Google's own seal.

For organisations, the practical advice is unglamorous. Hunt for MECOOL and similar devices on the network using Synthient's published indicators, disconnect and dispose of any that appear, block the listed command-and-control domains and IPs, and keep consumer smart devices on a separate network segment from anything sensitive. TrendAI's addition matters for remote work: an unmanaged TV box on an employee's home network is part of the corporate attack surface, whether or not IT ever heard of it.

Sources