When Google dismantled the XCPE botnet of 1.3 million Android TV boxes, the question hanging over the story was what would happen to the manufacturer.

The answer has arrived: Google has ended its relationship with Shenzhen-based Videostrong entirely, banning the company and any subsidiaries — including its consumer brand Mecool — from using Android apps and services, and AndroidGuys reports the ban extends to building or supplying software for any future certified Android devices.

This is the supply-chain equivalent of the death penalty for a hardware brand. Google also notes it is updating its certification process to close the loophole that let Videostrong install malware after devices first booted and went online, so this is both a punishment and a policy change.

The striking part of this case is that these were Google-certified boxes, mostly sold under the Mecool brand, meaning they had passed the compatibility and security screening that is supposed to catch exactly this kind of threat.

According to Google's Threat Intelligence Group, Videostrong evaded detection through obfuscation techniques and a backdoor that only activated after devices were set up and online — a stub app called x.cpe or com.oemservice that used its system-level permissions to install malware modules and disable Play Protect.

A manufacturer deliberately infecting its own customers, as Krebs on Security quotes Google saying, is 'an unacceptable breach of trust,' and Synthient founder Ben Brundage calls this probably the largest operation ever against backdoored TV boxes.

Google worked with Japan's National Police Agency, Synthient, and Trend Micro, taking legal action to seize the domains and command-and-control servers Videostrong used, and estimates the operation severed access to about 10 million additional compromised devices — including Android-based healthcare devices, karaoke machines, and digital signage, per Krebs on Security.

Trend Micro counted 1,472,554 infected TV boxes, slightly above Google's estimate, concentrated in Brazil, Malaysia, Iraq, Mexico, and Taiwan, with tens of thousands in the US, Germany, the UK, Australia, and Canada.

Krebs on Security also reports the malware downloaded proxy SDKs from providers including AppSalt/Honeygain and the FBI-seized NetNut, and Synthient has published a list of 182 affected device model names.

Here is where the story turns genuinely bad for owners: even after the takedown, infected devices are not really safe. Google says Play Protect remains disabled and the inert malware modules are still installed as system apps that users cannot easily remove.

AndroidGuys reports the malware is signed with the manufacturer's own keys, so a factory reset simply reinstalls it from the core firmware.

Security experts quoted by AndroidGuys recommend treating any Mecool or linked box as fully compromised — unplugging it, disconnecting it from the network, disposing of it, and changing the home Wi-Fi password to clear any lingering access.

Google's action closes one door but not the whole problem. Android is open source, so Google warns Videostrong could keep selling uncertified Android-based TV boxes under other brands without Google apps — though it would have to rebuild its malware operation from scratch.

Synthient's Brundage told Krebs on Security that the 1.3 million figure is 'highly conservative' and the real scale is likely far higher.

The broader lesson, per AndroidGuys, is to buy smart home hardware from mainstream brands with proven supply-chain security, especially as cheap streaming boxes marketed by social media influencers keep promising hundreds of channels for a one-time fee.