Google Exposes Android Partner Videostrong’s 1.3 Million‑Device Botnet

Whoa! Google has just pulled the curtain on a massive security breach involving one of its Android manufacturing partners.

According to Google, Shenzhen‑based Videostrong Technology Co. “intentionally” embedded a backdoor in 1.3 million Android devices, converting them into a botnet that operated without owners’ knowledge.

The infected hardware was primarily Android TV set‑top boxes, but the malware also spread to other Android‑based IoT gadgets, including telehealth devices, karaoke machines, and digital signage devices. Google says the malicious code was built directly into many different models and brands over multiple years.

Once activated after the first boot, the backdoor allowed Videostrong to sell access to criminal affiliates. Those affiliates loaded additional malware modules that performed ad‑fraud, silently enrolled devices into residential proxy networks, and injected further malicious code into compromised units.

Google reports that the affiliates’ diversified distribution channels could affect “at least 10 million additional compromised devices” once their command‑and‑control (C2) domains are taken down.

In response, Google has disrupted the C2 domains, removed the backdoor, and cut ties with Videostrong. The company also announced that Videostrong is now banned from building or selling certified Android devices or supplying software for them.

Google says the manufacturer used “obfuscation techniques” to load the malware after users first powered on the hardware, and the tech giant has pledged to revise its review process for device manufacturers to prevent similar incidents.

That’s a huge win for security, but a stark reminder that even trusted platforms can be compromised from the inside.