In a recent security disclosure, Google announced the removal of a clandestine backdoor that had infected more than 1.3 million Android devices. The malicious code was traced back to Shenzhen-based Videostrong Technology Co., an OEM/ODM that secretly embedded the payload during manufacturing. The compromised hardware—ranging from Android TV set-top boxes to telehealth units and digital signage—was silently recruited into a large-scale botnet that supported ad-fraud schemes, data exfiltration, and unauthorized network routing.
Google’s investigation uncovered that the covert operation had been active for several years, affecting multiple device models and brands. Victims were unaware that their appliances had been turned into rentable compute nodes for criminal affiliates, who could remotely install additional malware modules and rent the devices as residential proxies or ad-click farms. The scale of the operation, combined with the variety of hardware involved, highlights a new frontier in supply-chain-based cyber threats.
Scope of the compromise and the devices hit
The Android botnet leveraged more than 1.3 million units, primarily Android TV set-top boxes, but also an assortment of IoT products such as karaoke machines, telehealth monitors, and digital signage displays. Each infected unit carried the malicious stub from the moment it was first booted, allowing the attacker to gain system-level privileges without user interaction. Google estimates that the botnet’s reach extended to at least ten million additional devices through secondary modules distributed by criminal affiliates. These affiliates used the compromised hardware as a platform for ad fraud, converting harmless device traffic into revenue-generating clicks, and as exit nodes for residential proxy networks that mask the true origin of illicit traffic.
Architecture of the hidden backdoor
The malicious package, identified in the firmware as x.cpe (sometimes reported as com.oemservice), operated in a three-stage modular fashion. First, the primary backdoor loaded during the device’s initial boot and persisted across reboots by reinstalling itself from a protected OEM partition. Second, a lightweight loader and execution engine—named com.abc.nexus in later variants—handled communication with remote command-and-control (C2) servers and delegated the execution of payloads. Finally, the monetization modules, supplied by external affiliates, turned the device into an ad-click generator, a proxy exit point, or a conduit for further malware such as additional backdoors.
Communication with the C2 infrastructure employed a two-step approach. An initial HTTP POST retrieved encrypted configuration data, after which the device established a persistent MQTT connection to receive real-time commands. Through this channel, operators could silently install new APKs, disable Google Play Protect, capture screenshots, execute arbitrary shell commands, and exfiltrate system logs. To evade detection, the malware used obfuscation techniques, encrypted payloads, and native anti-analysis binaries, allowing it to survive standard Android compatibility tests.
Google’s response and industry collaboration
Upon confirming the threat, Google terminated all relationships with Videostrong Technology Co. and barred the company from manufacturing or supplying certified Android devices in the future. The tech giant also disrupted the botnet’s command and control domains, effectively severing access to an estimated ten million secondary compromised devices. In parallel, Google overhauled its device-review workflow, tightening firmware integrity checks to close the loophole that the backdoor exploited.
The takedown effort was coordinated with a coalition of partners, including Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. Legal actions were taken to shut down the domains and servers used for C2 traffic and module distribution. While Google acknowledges that this disruption will hamper the immediate criminal operations, it also stresses that persistent monitoring and future enforcement actions will be necessary to dismantle the broader supply-chain-based malware ecosystem.
