More than 1.3 million Android TV devices — especially set-top boxes that turn ordinary televisions into smart ones — were infected with malware installed at the factory before products reached buyers, according to a Google Threat Intelligence Group investigation reported by Mediafax.

The company named is Videostrong Technology, a Chinese maker of Android equipment. Google says the malware, called XCPE, was deliberately built into firmware, turning the devices into a remotely controlled network.

Unlike typical attacks, users did not need to download a suspicious app. The code was embedded in the device software and could activate after first boot. Google says Videostrong ran the system and sold access to operators involved in illegal activity.

Those operators used owners’ internet connections to redirect traffic, generate fake ad views and install further malware. XCPE had broad permissions: screenshots, simulated key presses, collection of account and app data, and disabling Google Play Protect.

Persistence was high: if a user removed the related app, it reinstalled after reboot because code remained in the system partition. The mechanism was changed several times since 2024 to evade detection.

Google worked with security firms and authorities to block the command-and-control infrastructure. The company estimates the action may also cut criminal access to at least 10 million other devices compromised through related networks. Videostrong has been cut off from Google partnerships and barred from shipping devices with preinstalled Google apps.

Experts warn that deleting an app or rebooting is not enough. Owners who suspect an affected TV box should disconnect it from the internet and seek clean firmware or a replacement. Google has not published a full list of compromised models.

Source consulted: Over 1.3 million Android TV devices infected with manufacturer-installed malware. Google’s accusations — Mediafax.

Image: Android Tracer set-top box (Wikimedia Commons, CC BY-SA 4.0).

Sources consulted: Over 1.3 million Android TV devices infected with manufacturer-installed malware. Google’s accusations — Mediafax.