Google Cuts Ties With Videostrong Over Android Backdoor
Google banned the Android TV box maker from selling certified devices after its built-in backdoor was found to enable malware distribution.
Updated on Nov. 2, 2026 in Cybersecurity
Live Poll
Do you trust streaming box makers to keep malware off their devices?
Google has cut ties with Videostrong, a manufacturer of certified Android TV boxes, after finding it built a backdoor into devices it could sell access to. Google also took legal action to block the domains and servers used to control the XCPE botnet.
Why it matters
The backdoor was built into many device models and brands over multiple years, leaving affected users exposed to malicious software. Taking down the control domains is expected to sever access to at least 10 million additional compromised devices.
Videostrong employed obfuscation techniques to exploit a gap in Google's testing and load malicious code after a device's first boot, and the takedown is projected to sever access to at least 10 million additional compromised devices. Synthient's compiled list of potentially affected devices centers on the Mecool brand, while the full scope across other brands has not been identified.
The players
Google is the technology company that certifies Android devices and operates the Android platform, and it set the policy that Videostrong violated.
Videostrong
Videostrong is a manufacturer of certified Android TV boxes whose devices carried a backdoor it could sell access to.
Synthient
Synthient is a security research group that compiled a list of potentially affected devices, focused on the Mecool brand.
The details
Google banned Videostrong and its subsidiaries from selling certified Android devices and from selling software to other certified vendors. The company also updated its review process to protect users against this type of behavior, after bad actors used obfuscation to load malicious code after the device's first boot.
Timeline
November 2, 2026: Google announced it was cutting ties with Videostrong in a post.
Cybersecurity Context
Google's Android certification program depends on vendors meeting its review process, and this case shows a gap that let obfuscated malware pass initial tests. The enforcement action against Videostrong and the updated review process mark a response to that gap within the platform's existing certification framework.
Owners of certified Android TV boxes from affected brands may want to check whether their device has been flagged, particularly Mecool models. Google's updated review process is intended to better protect users against this type of behavior going forward.
The takeaway
Certified devices can still carry hidden risks when malicious code activates after first boot, so buyers should watch for brand-level warnings. Platform review processes are being tightened in response, but affected owners should verify their devices.
Further reading
For more on how botnets and device backdoors are tracked, see Cybersecurity coverage.
Live Poll
Do you trust streaming box makers to keep malware off their devices?
