More than 1.3 million Android TV devices have been turned into remotely controlled networks after malware was installed on them as early as production. Google's threat intelligence group, Google Threat Intelligence Group, investigated the program, called XCPE, and attributed it to the manufacturer Videostrong Technology, a company that makes Android TV boxes.
According to the investigation, the malware was integrated into the devices' software before they reached buyers. Users did not need to download anything suspicious to be affected, and the program could be activated from the device's first boot. Google states that Videostrong built and managed the system deliberately, and the accusation is a direct one, targeting the manufacturer's responsibility rather than a third party that would have compromised the devices later.
The company claims that access to the devices was sold to operators involved in illegal activities. They used the home internet connections to redirect traffic, generate fake ad views and install other malware. For this reason, the victims are not only the users who bought the devices, but also the home networks that were used without their knowledge.
The malware had broad permissions within the Android system, which allowed it to receive remote commands. Reported capabilities include taking screenshots, simulating keystrokes and collecting data. The program could also disable Google Play Protect security checks, the mechanism through which the Android system scans installed applications, meaning the platform's usual protections offered no secure barrier against it.
An important detail concerns how the infection persists. If the application was removed, the malware reinstalled itself automatically after the device restarted. The code had been modified several times since the beginning of 2024, precisely to avoid detection. According to Google, simply removing the application or restarting the device may not eliminate the infection, which makes it difficult for owners to clean their devices.
Google, security firms and authorities blocked the servers that sent commands to the devices, a coordinated action meant to interrupt the network. The company estimates that the intervention could affect at least another 10 million compromised devices, a figure considerably higher than the 1.3 million devices initially mentioned. Google ended its partnership with Videostrong and banned the preinstallation of Google applications on the company's products, a measure that shows the seriousness of the accusations. However, the tech giant has not yet published the full list of affected models, which leaves many owners without the ability to quickly check whether their device is vulnerable.
Owners of these devices are advised to disconnect them from the internet and look for secure software solutions or replace the devices. The case shows how vulnerable networked devices can be when such a program reaches the software delivered from the factory, and how responsibility for the security of the production chain has become a central issue for the entire industry.