Chinese Videostrong botnet hit Android TV boxes in Australia: researchers

A Shenzhen, China-based maker of Android TV streaming boxes built a backdoor into its own firmware and sold access to the infected devices to criminal, leaving Australian users exposed to unauthorised access.

Google and its industry partners said they dismantled the botnet, named XCPE, in late October after it had enrolled more than 1.3 million devices.

The Google Threat Intelligence Group (GTIG) said it assessed with high confidence that Videostrong Technology developed, deployed and operated the backdoor for financial gain.

Videostrong sold access to criminal affiliates and loaded their malware onto the boxes, GTIG said.

Those add-on modules committed advertising fraud, installed further malware and turned the boxes into exit nodes for residential proxy services.

Such services rent out the internet connections of regular households, letting buyers hide their traffic or appear to be from somewhere else.

They are also a common source of account takeover attempts, ad fraud and mass content scraping for artificial intelligence.

Separately, Plume Security Labs, one of Google's partners in the operation, mapped {pdf] infections from the botnet's command traffic and showed clusters around Sydney, Melbourne, Brisbane, Perth and Adelaide. 

Researchers at Synthient found the same Videostrong malware in boxes sold under the MECOOL brand by Chinese listed company Skyworth Technology.

The backdoor ran with system-level privileges, reinstalled itself if a user removed it, and switched off Google Play Protect's app verification.

Beyond silent app installs, GTIG said Videostrong operators captured live screenshots, injected keystrokes, stole account information and opened reverse shells on devices.

The malware was not confined to TV boxes, with GTIG finding it in telehealth devices, karaoke machines and digital signage.

Google has cut ties with Videostrong and barred it, along with any future subsidiaries or affiliates, from building certified Android devices or supplying software to certified vendors.

GTIG called a manufacturer deliberately infecting its own users "an unacceptable breach of trust".

Google's partners also took down command servers for more than a dozen malware families delivered through the backdoor.

GTIG estimated that would cut off access to at least 10 million more compromised devices, since the affiliates distribute their modules through channels other than XCPE.

The company appears to have adapted before, with GTIG saying Videostrong restructured its malware in late 2024, possibly in response to earlier Google enforcement against the BadBox botnet.

Google worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI on the case..

It advised consumers to buy connected devices only from reputable manufacturers, and to be wary of apps that offer payment for "unused bandwidth".