Google says one of its Android manufacturing partners, Shenzhen-based Videostrong Technology Co., secretly built a backdoor into 1.3 million devices and turned them into a botnet. According to Google, the backdoor and botnet were 'intentionally developed, deployed, and operated for financial gain.'

Infected devices were used without owners' knowledge for ad fraud, data exfiltration, and routing unauthorized network traffic.

Google says it has dismantled the backdoor, cut all ties with Videostrong, and banned the company from building or selling certified Android devices or supplying software for certified makers. The ban also covers any future subsidiaries or business partners.

What makes the case remarkable is the source: not a hacker exploiting a flaw, but a certified OEM and ODM allegedly monetizing its own customers. Google says Videostrong sold access to criminal affiliates and loaded their malware modules onto infected devices.

Krebs on Security notes the action is likely to sever the botnet's access to more than 10 million additional compromised systems beyond the TV boxes, since affiliates had diversified distribution channels.

Security Affairs reports the backdoor was found across many device models and brands over multiple years, run with dedicated infrastructure — not the work of a rogue employee or a coding mistake.

Google requires Android device makers to pass compatibility and security tests, but Videostrong got around them with obfuscation: the malicious code loaded only after a user booted the device for the first time, which the tests did not catch.

Security Affairs describes a three-stage design in which the primary backdoor runs with system privileges and reinstalls itself from the /oem/ partition if uninstalled, then hands off to a loader that installs affiliate modules.

Through an MQTT command channel, operators could install apps, take screenshots, record keystrokes, and disable Play Protect verification. Google says it has since addressed the weakness and changed its device review process.

Most infected devices were Android TV set-top boxes, but the malware also reached other Android-based IoT products, including telehealth devices, karaoke machines, and digital signage.

The botnet loaded software that made users' internet addresses available for resale by residential proxy services, which let customers anonymize traffic or spoof locations.

Krebs on Security reports the GTIG report names providers including AppSalt (Honeygain), NetNut, EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode, and that Security Affairs notes some kits enrolled devices without any consent screen.

Krebs on Security also reports Synthient found MECOOL-branded boxes from Skyworth bundled the same Videostrong malware.

Google warns that the underlying market is resilient: backdoor operators, ad-fraud rings, and proxy providers form an interconnected supply chain that swaps loaders when disrupted.

The company is urging retailers and distributors to require independent security audits and delist implicated makers, and to demand auditable proof of consent from proxy providers.

For consumers, Google advises caution with apps paying for 'unused bandwidth,' sticking to trusted app stores, reviewing third-party VPN permissions, keeping Play Protect on, and buying devices only from reputable manufacturers.

Krebs on Security reports Synthient's founder called the 1.3 million figure 'highly conservative,' saying the affected scale is likely far higher.