Google bans Videostrong over a backdoor built into 1.3 million TV boxes

PPC Land is now also on WhatsApp, with a new PPC Land channel carrying its stories.

Subscribe Channel

The most consequential advertising story of the weekend was about ads that were never seen. On Saturday, November 7, PPC Land reported that Google had removed the Chinese set-top box maker Videostrong Technology from its certified Android programme, after Google's own threat researchers found that the company built a backdoor into its devices and sold access to criminal groups. More than 1.3 million boxes were enrolled in a botnet that fired impression beacons for ads no one saw, ran hidden browser windows that scrolled and clicked, and rented out home internet connections as residential proxies. It is a reminder that the cheapest screens in the living room can be the most expensive for advertisers. The rest of a quiet Saturday followed the same thread of who controls the identity and the inventory behind an ad. Meta moved users into a single Meta Account without asking first. TikTok told advertisers that the weeks after Christmas are a two-month bargain. Amazon published a culture study that leads, unsurprisingly, to Amazon's own media. And Google tested two small changes to search ads that could change who clicks and who pays.

The Landline newsletter can also be heard. Marketing Is Calling reads each edition aloud every day, on Spotify, Apple Podcasts and YouTube. Marketing Rodeo picks the most controversial advertising story of each day, weekends included, and has some fun with it, on Spotify, Apple Podcasts and YouTube.

A backdoor sold by the manufacturer

PPC Land reported that Google banned Videostrong over a backdoor it built into 1.3 million TV boxes. On November 2, the Google Threat Intelligence Group published its findings on a backdoor called XCPE, which Videostrong built into its set-top boxes and then sold to criminal groups. Google and its partners took the botnet down the week before the report. Google removed Videostrong from the Android certified partner programme and barred it from preloading Google apps, and it took legal action against the control domains used by Videostrong and by more than a dozen malware families.

The language in the report is unusually direct. "Videostrong prioritized illicit post-sale recurring revenue over the safety and privacy of its users," the researchers wrote. "We believe this campaign wasn't an isolated rogue insider or a development oversight." The backdoor, they concluded, was "intentionally developed, deployed, and operated." That matters because the usual explanation for compromised devices is a supply chain failure somewhere upstream of the brand on the box. Here, Google says the brand on the box was the supply chain.

For advertisers, the most important detail is how the fraud worked. Google's researchers found modules that fired impression beacons and third-party tracking calls for ads that were never displayed. Two modules, named Fission and HiddenView, recorded ad views without rendering any creative at all. Another tool opened hidden browser windows that scrolled, clicked, typed and played media, behaving like a person who was not there. Those are the signals that verification vendors and buyers rely on to decide that an impression was real. The report names no ad network, exchange or advertiser that paid for the traffic, which leaves the most uncomfortable question for the industry unanswered: whose budgets bought these views.

Advertising was not even the main business. Residential proxy software was the larger revenue source, with up to three proxy kits running on a single device. Proxy networks rent ordinary home connections to anyone who wants traffic that looks like it comes from a real household, which is exactly what ad fraud and scraping operations need. Google named Linkfog, AppSalt and Honeygain, GaGaNode, NetNut's Popanet and Traffmonetizer among the kits found, and said AppSalt set user consent without ever showing a consent screen. Infections were heaviest in Malaysia, Brazil and Iraq. Most were Android TV boxes, but the list also included telehealth devices, karaoke machines and digital signage.

The scale may be larger than the headline. Google says that shutting down affiliate command servers will cut off at least 10 million more devices, and Ben Brundage of Synthient, one of the partners, called the 1.3 million figure a low estimate. Since at least late 2024 the operation has used a three-stage design with a separate loader, which allowed malicious code to arrive after the first boot. That is why Google's certification tests missed it. Google says it has changed its review process, without describing how. It worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI on the takedown.

The case lands as connected TV becomes the fastest-growing part of many media plans. Cheap, uncertified Android boxes have long been a known source of invalid traffic, but this is a case of a certified manufacturer doing the work itself. For buyers paying television prices for streaming impressions, the lesson is that device provenance is now part of brand safety.

The structure of the scheme also explains why it lasted. A manufacturer controls the firmware, the update channel and the first code that runs when a box is switched on. Verification tools sit much further down the chain, inside the app or the ad call, where they see the signals the device chooses to send. When the device itself is the fraudster, a beacon that says an ad was rendered is only as honest as the box that fired it. Google's decision to name the manufacturer, rather than a malware family, shifts the burden of proof onto hardware. It also raises a question for every platform that certifies devices: what a certificate is worth if the harmful code arrives after the test.

Meta moves everyone into one account

Meta changed the identity layer behind its ads without a vote. PPC Land reported that Meta forces users onto Meta Accounts with no opt-out offered. A notice emailed on November 5 told users that their Accounts Center, the hub that links Instagram, Facebook and Threads profiles, had already been converted into a "Meta Account." The notice reported the change after it had happened and offered no way to refuse it. In the example PPC Land examined, one Instagram profile and one Threads profile were moved into the new account.

Meta presents the change as a convenience. The Meta Account adds a shared login, passkey support and a single place for privacy and ad settings, and it extends to Threads, Meta AI and Meta's AI glasses. Meta says users can choose which profiles to include. Its help centre page says Meta Accounts are available only in some locations, which it does not name, and that "Meta Accounts must contain at least one profile or device." Two-factor authentication now applies across every profile in an account, and Help Net Security reported in April that shared ad-topic settings, such as limits on alcohol and gambling ads, could carry across profiles.

The plan was announced on April 23, 2026, with a rollout over roughly a year. What the notice does not say is how the new account interacts with European law. In the EU, Accounts Center has been the place where users decide whether Facebook and Instagram data is combined, under the choice Meta introduced in January 2024 in response to the Digital Markets Act. Neither the notice nor the help page says whether a Meta Account follows the same rules. The European Commission fined Meta EUR 200m under the DMA on April 23, 2025, and Meta is appealing; in March 2026 the consumer group BEUC said Meta's consent flow still breaches EU law.

For advertisers, the account is not a cosmetic change. It is the identity graph that decides which profiles belong to the same person, and therefore how frequency, targeting and measurement work across Meta's apps. A single account spanning social apps, an AI assistant and a camera worn on the face gives Meta a broader view of each user than any of its products had alone. Meta's revised business terms take effect on November 20.

The method matters as much as the result. A change announced in April, rolled out over a year and confirmed by email after the fact is designed to arrive without friction. Few users will open a settings page to see which profiles were merged, and fewer will read a help page that says the feature is available only in unnamed locations. For regulators who spent years forcing Meta to ask before combining data across its apps, an account that combines the apps by default and reports the change afterwards is likely to draw questions.

TikTok sells the quiet weeks

TikTok is trying to stretch the holiday season. PPC Land reported that TikTok says its CPMs drop after November across a two-month Q5 window. On November 2, TikTok published a post titled "Why Q5 is a golden opportunity for advertisers on TikTok," arguing that the period after the holidays brings lower prices and steady user activity. "The holidays end, but performance doesn't," the post says, and "Q5 isn't a bonus period. It's a strategic growth sprint." TikTok's two playbooks for apps and gaming define Q5 as December 1, 2026 to January 31, 2027. Meta's guidance from October 2025 described a Q5 of about three weeks. TikTok's version is roughly two months.

The evidence is thinner than the pitch. The CPM charts in the playbooks have no vertical axis, currency or values. The apps and gaming charts share a title and a data source but show different curves. TikTok says 70% of consumers plan to shop after December 25, citing the National Retail Federation, while other figures, such as 85% of users spending as much time on TikTok, come from a TikTok survey fielded in September 2023. One footnote reads "full source details to be confirmed." For apps, TikTok cites Sensor Tower data showing January took 12% of mobile ad spend against a 10.5% average for the other months; PPC Land noted that these cannot both be annual shares. TikTok itself hedges its CPM claim with the word "potentially." It also cites a 169% rise in "New Year, New Me" content, and Adjust data showing that US Android users of health and wellness apps acquired through TikTok generate 117% higher monthly revenue per user. For commerce sellers, TikTok said its GMV Max Pro affiliate cost optimisation and smart coupons are in beta in the US.

The playbooks are more precise about what they want advertisers to spend. They set a learning phase of a week. Daily budgets must be at least 50 times the target bid for mobile app install campaigns, 10 times for app event optimisation and 15 times for some other campaign types. Purchase campaigns need more than 10 conversions a day and 15 creatives, and gaming campaigns optimised for in-app ad revenue need more than three times their historical average budget, with a $300 daily minimum. The two playbooks give different multiples for similar campaign types. The measurement section advises switching off AppsFlyer's Advanced Privacy setting, at a time when Adjust reports a 38% opt-in rate to Apple's tracking prompt. Global mobile game spending reached $7.1bn in January 2026, up 5.4% on December, by Sensor Tower's count. TikTok's message is that prices fall when demand falls. Its playbooks make sure demand from its own advertisers does not.

The longer window is the real change. A three-week Q5 is a clearance sale after Christmas. A two-month Q5 that starts on December 1 overlaps with the most expensive weeks of the year and runs through the January resolutions season, which turns a seasonal quirk into a planning category. If advertisers accept that framing, budgets that would have ended in December carry into January, and the lower prices TikTok promises would, in part, be eaten by the advertisers it persuades to stay.

Amazon finds culture in its own media

Amazon Ads published research that argues advertising can heal a divided society. PPC Land reported that Amazon Ads says 70% of 21,600 adults feel society is more divided than ever. The study, "From Ads to Zeitgeist," was produced with the consultancy Crowd DNA and surveyed 1,800 adults aged 18 to 64 in each of 12 countries, between December 2023 and February 2024. It carries no publication date. Its headline findings are that 70% feel society is more divided than ever and 66% want more belonging, and it argues that brands can shape culture through shared values. "The brands that succeed are those that know who they are. They're not trying to fit in with different crowds," said Kate McCagg of Amazon Ads.

PPC Land found the report's own numbers in conflict. The share agreeing that advertising is an important way for brands to communicate values is 72% in the body and 66% in the appendix, and PPC Land's average of the country figures gives 70%. Two other statements also differ between text and tables. The country spread is wide: the five large European markets fall below the global figure on eight of nine statements about brands and advertising, and Japan is lowest on 16 of 20 statements. Only 33% of Germans agree that advertising helps people learn about other cultures, against 77% in the United Arab Emirates. PPC Land estimated that the global figures weight every market equally, which lets Gulf and Latin American markets lift the averages.

The report is organised around three trends: centres of inspiration, democratised creativity and new escapism. Its four case studies, from Under Armour, YSL Beauty, The Sims and Pepsi Max, include no performance metrics, and it does not disclose its panel provider, margin of error or response scales. Its recommendations point to Prime Video, Twitch, Amazon Music and Wondery. "There has been increasing atomization of culture, everyone getting a more fragmented, personalized feed," said Kate Scott-Dawkins, quoted in the report. The irony is that the solution on offer is another set of personalised feeds, sold by Amazon, which reported third-quarter advertising revenue of $19.64bn, up 10.9%.

Research of this kind is a sales document as much as a study, and it is read that way by buyers. Its value lies less in the headline percentages than in the country tables, which suggest that the same message about belonging lands very differently in Berlin, Tokyo and Dubai. A global average built by weighting every market equally hides exactly the differences a multinational advertiser would need to know. The fieldwork is also nearly three years old, collected before Prime Video's ad tier had finished its first quarter, which makes it an odd foundation for advice about where culture is heading in 2027. Amazon began running Prime Video ads in January 2024, the month the survey was in the field.

Prime Video books a first lady

Amazon's streaming service also scheduled its most politically charged release of the season. PPC Land reported that Prime Video puts a two-episode Melania series in more than 240 markets on November 20. Amazon MGM Studios released the trailer for "MELANIA, The Series" on November 6. The two episodes, "I. Family & Trust" and "II. Pride & Honor," cover Melania Trump's life, including the days after the 47th presidential inauguration, and will stream exclusively on Prime Video "in more than 240 countries and territories worldwide." Melania Trump and Marc Beckman are executive producers, and Brett Ratner directs. The release promises "content never before shared with the public."

It does not give a running time, a rating, languages or whether both episodes arrive on the same day. The companion film, "Melania," premiered at the Kennedy Center on January 29 and opened in 1,778 US theatres the next day with an estimated $7m weekend. CNN reported that Amazon paid $40m for the rights and committed about $35m to marketing; the film grossed $16.6m worldwide before arriving on Prime Video on March 9. Earlier reports had described a three-part docuseries, and the series was missing from the November schedule Amazon published on October 30.

For advertisers, the relevant fact is that Prime Video now carries ads by default in the US, with an ad-free tier at $4.99 a month since April 10. A series about a sitting first lady, released worldwide in the weeks after a midterm election, is the kind of programming some brands will seek out and others will block. Prime Video's contextual controls will be tested.

The audience is large. Amazon reported 315 million average ad-supported viewers worldwide in the fourth quarter of 2025, and the release's boilerplate still lists "more than 500" free ad-supported channels, where later Amazon releases cited more than 900, a small sign of how quickly that inventory has grown. Amazon's title page differs slightly from the release, listing the production company as "Ratpac Production" and availability simply as worldwide.

Google tests trust signals and new-customer bids

Google spent Saturday testing changes to search ads that could matter more than their size suggests. PPC News Feed reported that Google is testing a new "Site visits" design in sponsored results, crediting Sachin Patel of Search Engine Watch. The redesigned line sits below the ad description and above the sitelinks, with a small icon, a bold "Site visits:" label and an estimate such as "1M+ visits in past month." Google gave no test markets, timing or data source for the estimates. PPC News Feed linked the test to Google's introduction of a site visits asset in May 2026 and to Bing's visits label for ads in June. A traffic count is a popularity signal, and like review stars before it, it favours large advertisers over small ones by default. A shopper choosing between an established retailer showing "1M+ visits" and a new store showing nothing has been handed a reason to click on the incumbent that has nothing to do with price or product.

PPC News Feed also reported that Google Ads added an option to bid only for new customers, shared by Anthony Higman on LinkedIn. The setting, labelled "Only bid for new customers without changing bid strategy," sits in campaign settings and keeps an advertiser's current bidding in place. Advertisers must upload a customer list so Google can tell new customers from existing ones. Until now, the cleanest way to focus Google Ads on acquisition ran through Smart Bidding's customer acquisition goal. A switch that works without changing bid strategy gives advertisers a blunter but simpler tool to stop paying for clicks from people who would have bought anyway, provided they are willing to hand Google the customer list that makes it work. The trade is familiar: a more precise control in exchange for first-party data that Google can also use to improve its own models. PPC News Feed gave no rollout date, regional availability or eligibility details, and cited no announcement from Google.

Both tests point in the same direction as the rest of the weekend's news. Whether the subject is a TV box, a social account, a seasonal discount or a search ad, the value sits in knowing who is on the other side of the screen. Videostrong sold fake people. Meta consolidated real ones. Google wants advertisers to tell it which ones are new.