Google Bans TV Box Maker Videostrong Over 1.3M-Device Botnet

Google said on 2 November that Videostrong Technology Co., a maker of Android set-top boxes for other brands, built a backdoor into the firmware of more than 1.3 million devices and sold access to them to criminal affiliates. In a Google Threat Intelligence Group post, Google says it has cut ties with Videostrong and “banned them from making devices with preloaded Google apps”.

Google also says it took down the command servers of the affiliates’ own software, and assesses that this “will sever access to at least 10 million additional compromised devices”. By our arithmetic, that puts the reach of the takedown at 11.3 million devices or more, and Videostrong’s own boxes are about one in nine of them, 11.5%. As we read it, the certification ban closes the factory door, while the domain takedowns reach the other 10 million.

What Google Says Videostrong Did

Google describes Videostrong as an Android original equipment manufacturer and original design manufacturer, and says it assesses “with high confidence” that the backdoor and the botnet were “intentionally developed, deployed, and operated for financial gain” by the company. Google says it and industry partners dismantled the backdoor, which it calls XCPE, “last week”.

Google says it found the software “built directly into many different device models and brands over multiple years”, and that “this campaign wasn’t an isolated rogue insider or a development oversight”. The overwhelming majority of infected devices were Android TV set-top boxes, Google says, but it also observed infected telehealth devices, karaoke machines and digital signage.

Videostrong made money, according to Google, by “selling access to criminal affiliates” and loading their modules onto the boxes. Those modules carried out ad fraud, enrolled devices into residential proxy networks without the owners knowing, and loaded further malware. Google worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI on the disruption.

Certification Is the Lever Google Pulled

Google lists four actions. It took legal action to take down the domains and servers Videostrong used to control the botnet, and the command domains used by more than a dozen malware families loaded through the backdoor. It banned Videostrong “and any future subsidiaries or affiliates from building and selling certified Android devices in the future, or supplying software to other certified vendors”. And it is improving how it checks the integrity of firmware on certified Android TV devices.

Google says it requires device makers to pass “a comprehensive suite of compatibility and security tests”, and that Videostrong used obfuscation “to exploit a gap in our tests and load malicious code after the device’s first boot”. Google says it has since changed its review process.

As we read it, certification is the commercial gate here: Android itself is open, but a maker that wants Google’s apps on the box has to pass Google’s tests, and losing that status cuts a hardware company off from the certified market. Google also puts the job beyond itself, saying retailers and distributors “should require independent security audits from Original Design Manufacturers (ODMs) and swiftly delist manufacturers implicated in supply-chain abuse”.

The Business Model: Proxies and Ad Fraud

Most of the modules were residential proxy and bandwidth-sharing services, Google says, with ad fraud modules as well. It saw “as many as three residential proxy SDKs installed on a single device”, which it says shows that Videostrong “seeks to monetize every infected device to the greatest extent possible”. Google names the proxy software development kits it found on the boxes, among them NetNut’s Popanet SDK, EarnFM’s Fleet SDK and the AppSalt SDK, which Google says is owned by Honeygain, in turn owned by Oxylabs. Google describes these modules as developed by entities other than Videostrong.

TrendAI, one of the partners, published its own measurements the same day in a research post. From 3 June to 1 October 2026 it counted 1,472,554 infected devices across 206 models in more than 170 countries, and 3,849,226 distinct residential exit IP addresses. On an average day the proxy product offered 182,025 household IP addresses, with a peak of 366,562, according to TrendAI, which says every figure is a lower bound.

By our arithmetic, the average daily pool is 4.7% of the distinct addresses TrendAI counted over the four months. TrendAI says the operator scheduled its proxy and ad fraud modules onto about 1.33 million devices, and that each box “generated ad impressions from a real home connection, which ad verification treats as genuine audience”. TrendAI also says access through the boxes “was sold as residential proxy and AI gateway services”.

Google’s post also addresses the proxy industry directly. “In our analysis, these proxy operators only seek consent when they are forced due to platform policy and enforcement”, the post says, adding that claims of “ethical sourcing” must be backed by “transparent, auditable proof of user consent”.

Connecting the Coverage

Google’s post says that in late 2024, possibly in response to “earlier Google enforcement related to BadBox”, Videostrong moved its modules into a separate package, and TrendAI places the operation in the same ecosystem as BADBOX 2.0, which it says was disrupted in March 2025. In October we reported that Anthropic says self-replicating AI could run on $55 TV boxes. For the general mechanics of gated ecosystems, see our guide to platform business models.

As we read it, the business lever is Google’s control of what counts as a certified Android device: it can remove a supplier from the certified market in one decision, while the 10 million devices beyond Videostrong’s own boxes needed legal action against the affiliates’ servers.

The Structural Read

As we read it, the certified label is Google’s strongest commercial tool in this case: according to Google, Videostrong and any future subsidiaries or affiliates are barred from building and selling certified Android devices and from supplying software to certified vendors.

As we read it, the money in this model comes from household addresses: TrendAI counted an average of 182,025 residential IP addresses on offer per day, 4.7% of the 3,849,226 distinct addresses it saw over four months, by our arithmetic.

As we read it, Google is asking the rest of the hardware supply chain to act as well: its post says downstream brands, resellers, telecommunications providers and online marketplaces share responsibility for closing this route.

Three Implications

FOR RETAILERS AND MARKETPLACES Google says retailers and distributors should require independent security audits from the manufacturers that design devices, and delist manufacturers implicated in supply-chain abuse.

FOR ADVERTISERS TrendAI says the operator scheduled its ad fraud module onto about 1.33 million devices, and that each box generated ad impressions from a real home connection.

FOR RESIDENTIAL PROXY PROVIDERS Google says claims of ethical sourcing must be backed by transparent, auditable proof of user consent, and that silent opt-in remains the most common way devices become exit nodes.

The Business Engineer Lens

This story maps onto the Business Engineer framework The Open vs Closed Meta-Framework.

The framework puts it this way: “Close the SCARCE layer (keep proprietary) + Open the ABUNDANT layer (commoditize)”.

As we read it, Android fits that pattern: the operating system is open to any maker, while the certified label and Google’s preloaded apps stay under Google’s control, and that is the layer Google withdrew from Videostrong. The framework was published in March 2026 and does not discuss this case.

Related coverage: Anthropic says self-replicating AI could run on $55 TV boxes · Platform business models explained

What Is Not Established

This piece is based on the Google Threat Intelligence Group post of 2 November 2026 and TrendAI Research’s post of the same day. The finding that Videostrong acted intentionally is Google’s assessment, and the 10 million figure is Google’s estimate of what the domain takedowns will reach; neither has been tested in court as far as the documents we read say. Google’s post refers to legal action but, in the parts we read, does not name a court or a case.

Device counts differ between partners, which TrendAI says reflects when each snapshot was taken. Neither post gives a figure for how much Videostrong or its affiliates earned. The 11.3 million total, the 11.5% share and the 4.7% daily pool are our arithmetic. We did not contact Videostrong, Google or the companies named.

The Bottom Line

Google says Videostrong built a backdoor into more than 1.3 million of its own set-top boxes and sold access to affiliates who ran residential proxies and ad fraud on them. Google has banned the company and any future affiliates from certified Android, and says taking down the affiliates’ servers reaches at least 10 million more devices, 11.3 million or more in all by our arithmetic.