Google banned Videostrong from building, selling, or supplying software for certified Android products after finding the firm pre-loaded backdoors onto 1.3 million devices. The manufacturer monetized this access over multiple years by facilitating ad fraud, data exfiltration, secondary malware installation, and residential proxy networks. Beyond disrupting the primary backdoor, Google dismantled command-and-control domains, severing criminal access to an estimated 10 million additional compromised devices. Google has since updated its review protocols for hardware manufacturing partners to prevent similar supply-chain compromises.
Key points
Manufacturers can covertly weaponize initial device boot sequences to enable long-term, p…: Manufacturers can covertly weaponize initial device boot sequences to enable long-term, profitable cybercrime operations.
Google dismantled extensive criminal infrastructure to remediate millions of vulnerable I…: Google dismantled extensive criminal infrastructure to remediate millions of vulnerable Internet of Things endpoints.
Review processes for certified Android device partners have been updated to counter firmw…: Review processes for certified Android device partners have been updated to counter firmware-level supply chain threats.
Sources checked by our analysis pipeline: 1
Google says one of its Android manufacturing partners secretly built a backdoor in 1.3 million devices and turned them into a botnet. The company says it has now dismantled the backdoor and “cut ties” with the manufacturer, the Shenzhen, China-based Videostrong Technology Co., which has been banned from building or selling certified Android devices or supplying software for them.
One of Google’s Android partners turned 1.3 million set-top boxes into a botnet
Google says a manufacturer ‘intentionally’ hijacked its devices with malware.
Google says a manufacturer ‘intentionally’ hijacked its devices with malware.
The infected devices were used without owners’ knowledge for “malicious activity,” like ad fraud, data exfiltration, and routing unauthorized network traffic. Google claims the “backdoor and botnet were intentionally developed, deployed, and operated for financial gain,” saying:
Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices. These secondary modules were conducting ad-fraud; silently enrolling infected devices into residential proxy networks; and loading additional malware onto XCPE-compromised devices. We also took action to disrupt the command and control (C2)…
Retailers across seven nations suffered severe food spoilage overnight after hackers manipulated operational controls to spike cooling temperatures up to 50C (122F). European Union officials warned the coordinated disruptions represent targeted efforts to destabilize the region's food supply and erode public confidence. The breach highlights escalating risks to remotely monitored retail infrastructure amid broader security concerns over hybrid warfare in Europe.
The enterprise database deployment allows organizations to execute serverless, mission-critical operations directly within the Databricks Data + AI Platform. By removing standard infrastructure management overhead, teams can power low-latency real-time applications and autonomous AI agents more effectively. The launch directly reduces operational complexity for businesses running mixed transactional and analytical workloads on Google Cloud.
The tech giant is shifting its focus toward mixed reality hardware to prepare its ecosystem for next-generation devices releasing in spring 2027. Despite millions of active users remaining on the discontinued hardware, future development will prioritize newer headsets that offer advanced processing power and shared software kits. This phaseout establishes a technical foundation for the upcoming product lineup while giving current users ample transition time.