Google cuts ties with Videostrong after 1.3 million Android devices hijacked

Google says a Shenzhen‑based Android partner built a backdoor in 1.3 million devices and turned them into a botnet. The partner, Videostrong Technology Co., has been banned from making or selling certified Android hardware and from providing Android software. The hidden backdoor let criminal affiliates run ad‑fraud, steal data and route unauthorized traffic through the devices. Google says Videostrong sold access to the backdoor and loaded affiliates’ malware modules on the infected units. Those modules enrolled phones and boxes in residential proxy networks, performed ad‑fraud and added further malware to XCPE‑compromised devices. Google disrupted the command‑and‑control domains that ran the affiliate modules, which it estimates will cut off access to at least 10 million other compromised devices. The malicious code was embedded directly into many models and brands over several years, mainly Android TV set‑top boxes but also telehealth kits, karaoke machines and digital signage screens. Videostrong used obfuscation techniques to install the code after the hardware’s first boot. In response, Google has changed its review process for device makers to catch similar threats earlier.

Context

Botnets built from everyday IoT gadgets are a growing security problem because the devices often lack strong safeguards. When many cheap boxes are compromised, attackers can earn large sums from ad fraud or sell proxy access. Strengthening manufacturer checks helps protect users and the wider internet.