Google announced the successful dismantling of a massive botnet affecting approximately 1.3 million devices, following the discovery of a backdoor secretly embedded in smart TVs and streaming platforms by one of its manufacturing partners. The company confirmed it has completely severed ties with the involved manufacturer, Videostrong Technology Co., based in Shenzhen, China, and permanently banned it from building or selling certified Android devices or supplying software for them.
Malicious activities and widespread exploitation
The infected devices were used without their users' knowledge to carry out malicious activities including ad fraud, data leaks, and routing untrusted network traffic. According to Google's clarifications, the backdoor was intentionally developed and implemented for financial gain, as the manufacturer generated profits by selling access to the devices to rogue third parties and installing secondary malicious software modules that in turn carried out ad fraud and silently enlisted the devices into residential proxy networks.
The damage was not limited to a single model; the malware was detected embedded directly within multiple models and commercial device brands over several years. Infections included Android TV streaming devices as well as other Android-based Internet of Things (IoT) devices such as telehealth equipment, karaoke machines, and digital signage displays.
Containment measures and technical handling
Google disabled and took down the command and control (C2) domains operating those subsidiary modules. Given that these actors relied on multiple distribution channels, Google estimated that disabling the command and control domains would cut off access to approximately 10 million additional potential devices compromised through other channels.
What changes practically?
This field incident resulted in important changes to Google's internal policies, including a review of screening and auditing procedures for certifying manufacturer devices to ensure such structural, artificial vulnerabilities are not repeated in user hardware, thereby tightening oversight on global Android product supply chains.