Google bans Videostrong after dismantling set-top box botnet
November 4, 2026 11.56 Europe/London By Julian Clover


Google has banned device manufacturer Videostrong from its certified Android ecosystem after an investigation linked the company to a botnet involving more than 1.3 million set-top boxes.

Google Threat Intelligence Group alleges the manufacturer deliberately installed a backdoor and sold access to criminal affiliates. Infected devices were used for advertising fraud, routing third-party internet traffic and distributing further malware.

The infection extended worldwide. Google describes the botnet as globally dispersed, with geographical concentrations potentially reflecting the reach of individual device distributors. Although Android TV set-top boxes accounted for the overwhelming majority of infections, researchers also identified compromised telehealth equipment, karaoke machines and digital signage devices.

Google and partners, including Japan’s National Police Agency, disrupted the XCPE botnet’s control infrastructure. The action does not establish that affected boxes have been cleared of malware.

The findings raise questions about device certification. Google acknowledged that Videostrong exploited a gap in its tests by loading malicious code after first boot. It says firmware checks have since been strengthened.

The ban covers Videostrong and future subsidiaries or affiliates, preventing them from building or selling certified Android devices or supplying software to other certified vendors.

Google also took legal action against infrastructure supporting more than a dozen associated malware families. It estimates that disruption will sever access to at least 10 million additional compromised devices.

The allegations and enforcement measures are detailed in Google’s original report.