Google detailed the takedown on Monday, naming the China-based OEM/ODM as the developer and operator of the botnet, which is also tracked as X.CPE. Videostrong sold affiliates access to the infected devices, and they used it for ad fraud, data exfiltration and residential proxy services. The boxes also pulled down additional malware modules.
A Backdoor That Loaded After First Boot
Google says the infection was deliberate. Videostrong used obfuscation to get past Google’s compatibility and security tests, then loaded the malicious code only after a device’s first boot. That sequencing let the hardware look clean during certification and turn hostile once it was in a customer’s home.
The malware worked in three stages:
- A primary backdoor persisted on the
/oem/partition - A loader and execution engine supported it
- Monetization modules then ran further backdoors and loaded more components
Videostrong gave affiliates direct access to that backdoor, which, according to Google, let them profit from infected devices for long stretches.
The takedown combined legal action against the botnet’s domains and servers with help from Japan’s National Police Agency, Lumen, Human Security, Plume, Synthient and TrendAI. Google believes it cut off access to at least 10 million other devices as well, because the module operators had spread their malware beyond XCPE. Android TV boxes made up most of the infections, but telehealth devices, karaoke machines and digital signage were hit too. Technical write-ups are available from Plume, Synthient and TrendAI.
Hashlytics Take
The detail that matters is the timing trick. Because the payload loaded after first boot, the device Google tested and the device a customer plugged in were effectively two different products. Certification checks what a box does out of the factory, and Videostrong exploited the gap between that moment and everything after it. Google’s penalty is a ban on preloaded Google apps, which is meaningful for Videostrong’s business but does nothing for the boxes already in living rooms or for the next manufacturer willing to copy the method. Google admits as much, saying that when one component is disrupted, “operators quickly pivot to new loaders or rival monetization SDKs.” The takedown is real progress, but the supply chain that made it profitable is still intact.
Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates
