Google's Videostrong ban proves the "certified" label isn't enough

The easy lesson from the biggest Android TV botnet story of the year is "don't buy sketchy boxes." It's good advice. It's also not the whole story, and it lets the people who should have caught this off the hook.

Here is what happened. As BGR reports, Google cut ties with Videostrong Technology, a China-based manufacturer, after more than 1.3 million of its Android TV boxes were found running a backdoor called XCPE. Google's Threat Intelligence Group says it is highly confident Videostrong built the backdoor and installed it on purpose, then sold access to criminal groups. Google and several security firms took the botnet down last week.

The details are ugly. The malware came in the firmware, ran with system-level privileges and, according to Google, was used for things like ad fraud and residential proxy networks. In some cases operators were even taking live screenshots and pulling account information. Brazil is among the hardest-hit countries; O Globo headlines it as the second most affected, though infected boxes also turned up in the U.S.

The certified badge was supposed to prevent exactly this

The detail that should bother everyone is that Videostrong was not a fly-by-night clone maker. It was a certified Android partner. Google makes such manufacturers run devices through compatibility and security tests before they can ship with Google's apps. BGR says Videostrong hid its code so the tests wouldn't catch it, loading it only after the first boot.

So the neat story, "certified is safe, uncertified is a trap," doesn't survive contact with the facts. Our view: certification is still the better bet, because it at least gives you someone accountable and a company that can pull the plug, as Google just did. But it is a filter, not a guarantee. A test that checks the box on day zero and can be defeated by waiting for the second boot is a test written for honest manufacturers.

To its credit, Google says it has updated its review process so others can't slip malware past the tests the same way. That's the right move. It's also an admission that the old process had a hole, and it took a million-plus devices to find it.

Cheap boxes are where the incentives go bad

None of this makes budget hardware a safe choice. It makes it a worse one. When a box sells for very little, the margin has to come from somewhere, and Videostrong found a place: renting out its customers' devices and home internet connections. Synthient, one of the security firms involved, says it bought a Mecool KM9PRO Max in late 2025 and found the backdoor already on it. It also says boxes like these are popular with people who want to install third-party apps to get around DRM.

That's a point we'd underline, as opinion rather than fact: a buyer shopping for a box that does what mainstream devices won't is also a buyer unlikely to be looking at certification at all. Nobody should be blamed for wanting a cheap TV box. But the price you don't see is that your network, and possibly your accounts, are part of someone else's business.

Cleanup is unpleasant. Google found XCPE can switch off Play Protect's app verification, and if you remove the backdoor it reinstalls itself from the firmware on the next restart. Synthient's advice is to take the devices off your network, change your Wi-Fi password and update your router firmware. Per BGR, it estimates roughly half a million of the 1.3 million boxes still contact the operators' servers daily. Synthient has also posted a list of more than 180 device models tied to the campaign, though a model being on the list doesn't confirm that a particular unit is compromised.

What buyers should do, and what Google owes them

For buyers: if you own an off-brand box, check whether your model is on Synthient's list, and if it is, consider unplugging it. When buying, prefer devices from manufacturers with a real reputation to lose, and treat an unusually low price as a warning sign, not a bargain. And don't read "Google certified" as "audited forever."

For Google: banning Videostrong from building certified devices or supplying software to other certified makers is a strong response, and the court action against the domains and servers matters too. But the order of events is backwards. The ban came after the damage. Post-boot behavior checks, spot audits of shipped units and more scrutiny on firmware that keeps privileged access should be standard for a program that lets a company put Google's name on the box.

Our verdict: stay with certified devices, but stop treating the certificate as the end of the conversation. The Videostrong case shows that the supply chain is where trust is won or lost, and Google, as the one handing out the badge, has to look there earlier than it did this time.