Google has cut ties with Videostrong Technology Co., an Android device maker, and banned it from building certified Android hardware after concluding that the company deliberately planted a backdoor in its own set-top boxes and sold access to them to criminal groups. According to a report published by the Google Threat Intelligence Group (GTIG) on November 2, 2026, the backdoor, known as XCPE, had pulled more than 1.3 million boxes into a botnet that Google and a group of partners took apart the week before. The groups that bought access used the boxes to fake advertising activity, to route other people's internet traffic through household connections, and to install still more malware.

GTIG says it assesses "with high confidence" that Videostrong, which it describes as both an Original Equipment Manufacturer (OEM) and an Original Design Manufacturer (ODM), "intentionally developed, deployed, and operated" the backdoor and the botnet "for financial gain." BetaNews, which reported the action on November 3, describes Videostrong as a Chinese manufacturer of Android TV boxes. Neither GTIG's report nor the BetaNews account carries a response from Videostrong.

For the advertising market, the report's most consequential sections are not about Videostrong itself but about what it let others do. Among the modules loaded onto infected boxes, GTIG found code that fired impression beacons and third-party tracking URLs for ads that were never shown, and a separate application that ran hidden browser windows to scroll, click, type and play media with nobody watching. Google also says that taking down the command servers of these affiliate modules, which spread through other channels as well, "will sever access to at least 10 million additional compromised devices." The report does not name a single ad network, exchange or advertiser that paid for the resulting traffic.

In Short

A company that made Android streaming boxes hid secret software inside them and then charged criminal groups for the right to use those boxes, to fake ad views and to borrow the owners' home internet connections. That means advertisers may have paid for ads nobody saw, and families who bought the boxes had strangers' traffic and remote-control tools running inside their homes. Google has banned the maker from its certified Android program and taken down the servers that ran the scheme, but it has not published a list of affected models or said how boxes already in homes will be cleaned.

What Google did

GTIG lists four actions. Google took legal action to take down the domains and servers Videostrong used to control the botnet and install malware modules. It took separate legal action against command-and-control (C2) domains used by "over a dozen malware families loaded as modules via this backdoor." It banned "Videostrong and any future subsidiaries or affiliates from building and selling certified Android devices in the future, or supplying software to other certified vendors." And it says it is implementing improvements to how it ensures the integrity of firmware on certified Android TV devices.

According to BetaNews, the ban also means Videostrong can no longer ship hardware preloaded with Google apps. GTIG's own summary says the same: Google "has cut ties with Videostrong and banned them from making devices with preloaded Google apps."

The disruption was a joint effort. GTIG says it worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI to analyse the malware ecosystem and disrupt it.

Google also concedes that its own certification process missed the problem. "Google requires OEMs go through a comprehensive suite of compatibility and security tests to ensure a consistent and safe user experience across the Android ecosystem," according to the report. "However, Videostrong employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device's first boot." Google says it has changed its existing review process as a result. It does not say what the changes are.

The report frames the case as a deliberate business rather than an accident. GTIG says it found the malicious software "built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates." Its conclusion: "We believe this campaign wasn't an isolated rogue insider or a development oversight."

"A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users," GTIG writes. "Without users' knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors."

Built for profit after the sale

"The x.cpe network was built for ongoing profit," according to GTIG. "By giving malware affiliates backdoor access, the operators conspired to monetize these devices long after purchase." In the report's closing section, the charge is sharper: "Videostrong prioritized illicit post-sale recurring revenue over the safety and privacy of its users."

The model resembles a franchise. Videostrong supplied the hardware, the backdoor and the control servers. Other operators, which GTIG calls affiliates, paid for access and had their own code loaded onto the boxes. A diagram in the report sets out the chain. A first-stage server registers devices and hands them MQTT connection details. A second-stage MQTT broker then relays commands to the backdoor, x.cpe, which is preloaded on the boxes. The backdoor passes data and commands to a loader, com.abc.nexus, which installs and configures the modules, labelled "Ad-Fraud, Proxies, Backdoors." The modules talk to their own operators' C2 servers. Shell scripts and monetisation modules sit on separate, remotely hosted staging infrastructure.

That three-stage design is relatively new. "Since at least late 2024, Videostrong has evolved its pre-installed malware from simple single-stage droppers into a modular, three-stage architecture designed for resilience and multi-tenant monetization," according to GTIG. Earlier versions of x.cpe carried the monetisation modules inside them. In late 2024, GTIG says, Videostrong moved them out into the separate com.abc.nexus package, "possibly as a response to earlier Google enforcement related to BadBox." The aim, in GTIG's assessment, was to keep x.cpe itself from being detected.

The two sources differ on that timing. BetaNews places the split "around the time of Google's previous legal action against BadBox 2.0." Google's lawsuit against the operators of the BADBOX 2.0 botnet was filed on July 17, 2025, in federal court in New York, as PPC Land reported when Google sued the BADBOX 2.0 operators, several months after late 2024. GTIG's wording refers more loosely to "earlier Google enforcement related to BadBox" and does not identify which action it means.

How the backdoor works

A preload that reinstalls itself

The infection begins with a small stub package, called x.cpe in some builds and com.oemservice in others, which sits in the system partition of the firmware and runs at the android.uid.system privilege level. On boot, it looks in the device's /oem/ directory for the full x.cpe package and installs it into /data/app/. If a user uninstalls it from there, it reinstalls on the next reboot. "As a system preload, x.cpe cannot be removed by the user," GTIG writes.

x.cpe also exports two ContentProviders, Android's mechanism for sharing structured data between apps. These hold runtime parameters, device identifiers, proxy configuration blobs and execution flags, which other software in Videostrong's ecosystem can read. GTIG names one such application, Videostrong's YokaTV Player streaming software, as able to fetch configuration parameters supplied by the C2 server.

Two channels of command

Command and control runs in two stages. The device first makes an HTTP POST request carrying an AES-encrypted JSON object with its serial number, MAC address, model and firmware version. To decide where to send it, x.cpe checks a local configuration provider, then reads an Android system property, ro.mecool.device. If that property is true, the box contacts mcstb.anyevonline.com on port 8000. If not, it generates a hostname from its Android version and device type on the same domain.

Three endpoints answer. One returns the details of the MQTT broker, including hostname, port, authentication tokens and a topic structure built from the device's model and chip ID. A second returns URLs for ip-api.com and a Google STUN server, which the malware uses to establish its geolocation, public IP address and port mapping so it can traverse NAT boundaries. The same response supplies an upload address for files and logs, and flags that configure ad modules, named adBwmActive, adDevourUse and adDevourCode. A third endpoint provides module-level configuration, which x.cpe decrypts and stores in a SQLite ContentProvider called ShareProvider so modules can read it.

The persistent channel is MQTT, which GTIG describes as "a lightweight, publish-and-subscribe network protocol designed for low-bandwidth, high-latency, or unreliable remote networks." Every sample analysed to date used a single broker hostname, mqtt.szbboys.com, which resolves to two IP addresses, 219.134.163.210 and 219.134.163.211, and listens on non-standard ports 3885 to 3887. Netflow data on those broker nodes suggests the operators managed the broker through an HTTP REST API on port 8082, a WebSocket on port 8083 and an EMQX web administration console on port 18083, from IP space outside the botnet. GTIG adds that static analysis of current versions indicates they send and receive C2 communications exclusively over MQTT, while earlier versions used HTTP and then a blend of the two.

What the operators could do, and did

MQTT topics map to specific actions. The backdoor can silently download and install APKs. It can run arbitrary shell commands at system privilege and publish the results to the broker. It can download and run shell scripts. It can capture the screen continuously, compress the images to JPEG and send them over MQTT, and it can inject keystrokes. It can fingerprint the home network with an embedded traceroute binary, ping tests and AS-lookup WHOIS queries.

It also switches off Google's own malware scanner. A function in the code sets the Android global setting package_verifier_user_consent to -1, which disables Google Play Protect app verification. GTIG says the backdoor "first wipes user consent configuration on the device and then disables Google Play Protect," which is what lets it install and execute files without consent.

Most of the activity GTIG saw in C2 data was routine: installing, uninstalling and configuring modules. Not all of it. "We also observed Videostrong operators executing sensitive actions on the device, including capturing live screenshots; injecting keystrokes; exfiltrating sensitive data including account information, device information, package inventories, and system logs; and executing shell scripts and commands, including to establish reverse shells on devices."

Hiding from analysts

Many variants of com.abc.nexus extract a library called libseccomp_guard.so before starting any module. It filters system calls so individual threads cannot be paused or terminated, blocks interference from other processes and prevents child processes from spawning, all aimed at defeating automated sandboxes and security instrumentation.

The most recent change came in August 2026. Since then, new dropper packages have been pushed through the MQTT channel, in what appears to be a coordinated replacement: the arrival of the new packages lined up with a mass uninstallation of com.abc.nexus across the botnet. The new droppers pose as Android system applications, with names such as com.android.system.ntp and com.android.sso.auth.handler. Instead of acting as a general-purpose loader, each installs a single monetisation module, such as AppSalt.

Several variants carry a native file, libexploit.so, whose functions restart the device's adbd service as root and open an ADB shell. The app uses that access to remount the system partition as writable, copy itself into a new directory under /system/priv-app/ and write a permissions file granting itself android.permission.INSTALL_PACKAGES and android.permission.REBOOT. Operators control these droppers through shell scripts pushed via the broker. One system property triggers uninstallation and cleanup. Another keeps the app out of the system partition. A third, persist.networkstack.install_time, overrides the app's installation timestamp to match the other system packages, a technique known as timestomping.

The ad fraud modules

GTIG describes 13 malware families loaded through the backdoor. Eight turn devices into proxy exit nodes. Four carry advertising fraud functions, and two of those have a history with the BADBOX operations. The last, Spirit, is a multi-stage backdoor whose main job is fetching more code: GTIG says it observed Spirit "loading a significant amount of additional malware monetization modules," including some families that com.abc.nexus also loaded directly.

Fission: views without an ad

Fission is a dynamic code loading backdoor embedded within ordinary video applications. GTIG gives com.newtv.cboxtv as an example. Its first-stage plugin contacts a C2 server to download further modules. The decrypted second stage then fetches "execution targets and tracking URLs" from C2, and reports tracking metrics back in an unencrypted POST request.

The payload GTIG observed was configured for ad fraud, and the method is specific. "Rather than rendering visible advertisements in a WebView or UI component, the Stage 2 plugin executes headlessly in the background," the report says. The module queries ad server endpoints for ad placement responses, extracts both the primary impression beacons, which GTIG identifies by the parameter pvm, and third-party tracking monitor URLs, identified as pvtpm, and "immediately fires HTTP GET requests to each tracking endpoint to register a fake ad view without displaying creative content."

The consequence for measurement is direct. An impression counted this way is registered by the ad server and by the third-party tracking endpoints alike, yet no creative is drawn on any screen. When Fission runs inside two particular smart-TV application stores, identified by the package names com.changhong.appstore and com.tcl.appmarket2, it goes a step further: the plugin "initializes and triggers the ad SDK directly to report synthetic ad exposures." The report makes no allegation against the operators of those stores.

HiddenView: a browser nobody sees

HiddenView was loaded remotely from the operator's GitHub channel as com.ota.service. GTIG calls it "a standalone ad fraud application." It runs in the background behind a transparent window overlay and uses hidden WebViews to load targeted web pages and simulate user interaction, including scrolling, clicking, typing and media playback. It plays media unattended and captures the user's screen. One of the domains GTIG lists for it is hiddeninplainsight.top.

Moyu and Bird: familiar names

Moyu is a three-stage backdoor that GTIG says was "previously observed as part of the BadBox enterprise." On XCPE devices, it was started by a component called DevourService, a name that echoes the adDevourUse and adDevourCode flags in the C2 configuration. Its first stage is an offline dropper that rebuilds and loads an embedded second stage. That stage polls an update server to download, decrypt and load the third, which "implements a backdoor with hidden Double-WebView click/conversion fraud, persistent clipboard hijacking, and secondary dynamically loaded JAR execution and a separate residential proxy trojan." MoYu was among the groups named in PPC Land's coverage of BADBOX 2.0 in July 2025.

Bird is a two-stage backdoor also tied to BadBox. Its first stage sends a profile of the device and of the analysis environment to its C2 server, and only when the server approves does it download and decrypt the second stage. That stage includes a dynamic code loading backdoor, a downloader that performs silent APK installation and "Accessibility-driven Google Play installs," and ad abuse in the form of lockscreen ads, overlays and browser launches. The report does not say which apps were installed through Google Play this way, or whether any of those installs were credited to paid campaigns.

What the report does not say

GTIG documents mechanics, not volumes. It does not estimate how many fake impressions or clicks the modules produced, how much money changed hands, which ad servers the Fission plugin queried, which advertisers' tracking URLs it fired, or which pages HiddenView loaded. It does not say whether any of the traffic reached Google's own advertising systems. A configuration sample published in the report shows the module policy sent to one device, with the Linkfog proxy module enabled and five others, including one labelled admoyu, switched off. Modules were evidently switched on and off through configuration. How often the ad fraud modules ran across the botnet is not stated.

Three proxies on one television

Residential proxies are the other half of the business, and on GTIG's account the larger half. "Most often the modules are associated with residential proxy services and bandwidth sharing, but we've also observed ad fraud modules," the report says. A residential proxy routes a paying customer's traffic through an ordinary home internet connection, so that requests appear to come from a household. According to BetaNews, customers use them to disguise who they are or pose as being somewhere else, and defenders often find the traffic hard to distinguish from legitimate home users.

Videostrong did not limit itself to one. "Given that a single device may be running multiple modules providing the same or similar functionality (e.g., as many as three residential proxy SDKs installed on a single device) it is clear that Videostrong seeks to monetize every infected device to the greatest extent possible," according to GTIG.

The report names eight proxy and bandwidth-sharing modules:

  • Linkfog, a Go binary that turns devices into "residential edge computing and PCDN proxy exit nodes," connects to FRP reverse tunnels and uploads bandwidth accounting to Linkfog's servers. GTIG says Linkfog is operated by Beijing Linkfog Technology through Dianxinyun and describes itself as a "Peer-to-Peer Content Delivery Network."
  • Jaguar, a 32-bit native binary written in C that derives a ChaCha20 decryption key to decode its configuration and relays TCP and UDP traffic on command.
  • AppSalt, the residential proxy SDK owned by Honeygain, which is in turn owned by Oxylabs.
  • BWM / IPWeb, which registers with a remote server over UDP and opens a multiplexed TCP proxy tunnel "on behalf of a remote threat actor."
  • GaGaNode, the first-party SDK of the residential proxy operator IPCola, which both relays traffic itself and starts other proxy SDKs.
  • NetNut's Popanet SDK, started by GaGaNode.
  • Traffmonetizer, which multiplexes control messages and tunnelled connections over a single TLS WebSocket and supports "Content Delivery" tunnelling for bandwidth-heavy traffic.
  • EarnFM's Fleet SDK, also started by GaGaNode.

The AppSalt details stand out. The application fetches an AppSalt API key from a native library, then initialises the SDK "without displaying a consent screen - instead it explicitly calls the optIn() method which sets a consent flag without displaying any user interface." During startup, according to GTIG, the SDK "checks the application's installation source and stops execution if the application was installed from the official Google Play Store." Once running, it holds a WebSocket connection to its C2 domain and opens UDP and QUIC connections to proxy gateways. Of the network indicators GTIG publishes, 100 domains are labelled Honeygain / AppSalt, far more than any other family.

BetaNews describes AppSalt software as a regular presence on infected boxes. The outlet reports that Oxylabs, based in Vilnius, rebranded as Source in October 2026 after a reported $130 million investment from Warburg Pincus that valued it at $3.6 billion, and that Oxylabs did not reply to a request for comment.

GaGaNode's role points to a market inside the market. GTIG observed it starting the Popanet SDK from NetNut and EarnFM's Fleet SDK, and concludes that "GaGaNode/IPCola is thus likely able to further monetize its SDK and offer these affiliates access to the infected exit nodes." The Popanet code was "identical to the malware described in our previous disruption of NetNut," GTIG writes, linking to its earlier report on residential proxy networks, and all C2 infrastructure used by Popanet samples connected to x.cpe had already been taken down in that operation.

That earlier action is one PPC Land has followed. In early July 2026, the FBI, the IRS and Google reportedly disrupted NetNut's proxy network, which GTIG put at about 2 million devices, while NetNut's parent Alarum disputed the botnet allegation, as covered in PPC Land's report on Google returning wrong results on 11% of DemandSphere's rank checks. BetaNews adds that federal agents and partner organisations took down hundreds of domains tied to NetNut in July 2026, with the FBI accusing the company of running Popa, a botnet built from TV boxes that Google also disrupted that month. Alarum Technologies, which owns NetNut, is a publicly listed Israeli company, according to BetaNews.

One more proxy name appears at the edges. GTIG's indicator table lists a package called com.vs.grass among its com.abc.nexus samples, without discussing it in the text. According to BetaNews, Synthient founder Ben Brundage said the malware also pushed out the client of Grass, another proxy service. BetaNews notes that researchers at Censys had earlier found Grass's proxy code on the Superbox streaming device, and that Grass's founder said the company had no ties to that box's maker.

GTIG is blunt about the proxy industry's consent claims. "Residential proxy providers have been able to flourish under the guise of legitimate businesses," the report says. Any claims of "ethical sourcing" must be backed by "transparent, auditable proof of user consent." And: "In our analysis, these proxy operators only seek consent when they are forced due to platform policy and enforcement. Silent opt-in without user consent remains the most prevalent means by which devices are turned into exit nodes."

A franchise run on configuration files

Configuration messages pushed over MQTT show how tightly the operation was managed. When a device registers, it receives a message under the topic ext/lib/config. The sample GTIG published sets resource limits per module: for Linkfog, 70 for CPU, 50 for memory and 5,000 each for read and write I/O, with alarms reported back when the limits are crossed. Each module entry carries a code name, a channel label (SZKJ in the sample), download addresses for each processor architecture, MD5 hashes and a "weight" that sets its priority for system resources.

Devices are assigned to one of six server pools separated by time zone, on the domain ott.szbboys.com. The published example assigns a device in the region "Iraq" to "Pool5", with a lastUpdated value of August 6, 2025. A "policys" section then tells com.abc.nexus which modules to download and run. When the loader accepts the bundle, x.cpe replies to the broker: "received data success and applying."

Most of the files these instructions point to were not hosted on obscure servers. "A significant majority of these files are hosted as Github releases on operator-owned Github pages," according to GTIG. The indicator list names 11 GitHub accounts as operator-controlled, one of them called yf-videostrong. Other files sat on the filemail.com file-sharing service and on two operator-controlled servers at 38.145.197.135 and 23.94.49.57.

Where the boxes are

"While the overwhelming majority of the infected devices in the XCPE botnet are Android TV set-top boxes, we observed a number of other infected Android-based IoT devices, including telehealth devices, karaoke machines, and digital signage devices," GTIG writes.

A world map in the report shows the botnet's spread. Shading covers the United States, Canada and Mexico, Brazil, the United Kingdom, Germany, Spain, Turkey, Iraq, Russia, South Africa, Australia and much of South-East Asia, including Thailand, Malaysia and Indonesia. The deepest shades fall on Malaysia, Brazil and Iraq. The map carries no legend or scale, and GTIG gives no country counts, saying only that the botnet is "globally dispersed, with certain concentrations possibly implying market penetration for the brand distributor." China is not shaded.

GTIG does not name the brands or models involved, a gap BetaNews also points out. The code offers one clue: the C2 routine checks the ro.mecool.device property before choosing a server. According to BetaNews, a Synthient teardown of a MECOOL-labelled box, a product of the publicly traded Chinese company Skyworth Technology, found Videostrong's backdoor packaged alongside proxy components including AppSalt/Honeygain.

The 1.3 million figure may understate the problem. Synthient's Brundage described it as a low estimate. "The scale of affected devices is likely way higher," he told BetaNews.

Why it matters for advertising

The XCPE case lands on one of the most sensitive spots in digital advertising: the television in a real home. An infected box offers a household IP address and a genuine Android TV device behind it, whether its operators use it to fire ad beacons themselves or rent its connection to someone else.

Fraud in CTV has been rising. DoubleVerify reported that CTV fraud schemes and variants rose 140% in the first quarter of 2026 compared with a year earlier. In July 2026, HUMAN Security's Satori team disrupted NewsJunkie, a CTV fraud scheme that produced up to nearly two billion invalid bid requests per day per seller, and one of its two techniques paired residential IP addresses with forged CTV device data. HUMAN was one of Google's partners in the XCPE operation.

The proxy side matters for how invalid traffic is filtered. Augustine Fou has argued that residential proxies defeat IP-based detection and that click-based estimates undercount fraud on CPM-priced ads, citing BADBOX 2.0 among his examples. GTIG's report does not say what traffic the proxy customers sent through XCPE boxes. Its list of harms includes "routing malicious network traffic through the devices."

Fission poses a different problem. Post-bid verification relies on code that runs where the ad renders, and Fission renders nothing: it fetches the ad response and fires the beacons itself, so the ad server and the third-party trackers it calls each record an impression. The report does not say whether any verification vendor's endpoints were among the third-party URLs fired. The issue is related to, though distinct from, the problem of CTV ads that keep running when the TV is off: in both cases, a counted impression is no proof that anyone saw anything.

Platforms have started acting on proxy code in television software. In August 2026, Samsung said it would ban residential proxy SDKs from its Tizen TV platform, after research found proxy SDKs in more than a quarter of Tizen apps. The XCPE case shows the same business reaching the television through firmware, before any app store is involved.

Google's report treats the whole arrangement as one system. "Backdoor operators, ad-fraud rings, and residential proxy providers operate as an interconnected supply chain," GTIG writes. "Point-in-time disruptions are a critical tool to protect our users, but lasting disruption in this fluid ecosystem will require continued targeting of this infrastructure." Later it adds that "when one component is disrupted, operators quickly pivot to new loaders or rival monetization SDKs" - a pattern the report itself documents, from Videostrong's late-2024 restructuring to the August 2026 swap of loaders across the botnet.

What remains open

Several questions go unanswered in the report. There is no list of affected models or brands. BetaNews notes that the report is also silent on whether malware will be removed from boxes already in homes. GTIG's own description of x.cpe as a system preload that "cannot be removed by the user" makes that question more than academic. Taking down the known C2 domains cuts the boxes off from those servers, but GTIG's indicator list also names two fallback C2 domains for system packages, intermedia-arts.tv and yokatvonline.com, the second sharing a name with Videostrong's YokaTV player, and the report does not say whether either was taken down. It does not describe what Google changed in its certification review, beyond saying changes were made. Nor does it quantify the advertising fraud.

GTIG places part of the responsibility elsewhere in the supply chain. "Downstream hardware brands, white-label resellers, telecommunications providers, and online e-commerce marketplaces also share responsibility for closing this vector," the report says. It calls on retailers and distributors to require independent security audits from ODMs and to delist manufacturers implicated in supply-chain abuse. For consumers, GTIG warns against applications that offer payment for "unused bandwidth" or for sharing an internet connection, and points to its Android TV partner list as the reference for certified manufacturers.

Pre-infected Android hardware is not new. BetaNews recalls that researchers warned in 2023 that millions of devices carried malware before leaving the factory, and that Synthient documented another fast-moving botnet, Kimwolf, in January 2026, six months before the Popa action. What distinguishes XCPE, on Google's account, is who was running it: not a contractor slipping code into a supply chain, but the manufacturer itself, selling each box once to a consumer and then selling access to it, again and again, to affiliates.

Timeline

Summary

Who: Google, through the Google Threat Intelligence Group, working with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, against Videostrong Technology Co., an Android OEM and ODM, and the affiliates that bought access to its devices, including ad fraud operators and residential proxy providers such as Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, Traffmonetizer and EarnFM.

What: Google dismantled XCPE, a backdoor preinstalled on Videostrong devices that enrolled more than 1.3 million set-top boxes into a botnet. It took legal action against Videostrong's control servers and the C2 domains of more than a dozen affiliate malware families, banned Videostrong and any future subsidiaries or affiliates from certified Android devices and preloaded Google apps, and changed its device review process. Affiliate modules faked ad views by firing impression and third-party tracking beacons without displaying ads, ran hidden browsers that simulated user activity, and turned boxes into proxy exit nodes, up to three per device.

When: The takedown happened in the week before November 2, 2026, when GTIG published its report. BetaNews reported it on November 3, 2026. The malware's three-stage design dates from at least late 2024, and its latest change from August 2026.

Where: Infected devices were spread worldwide, with the darkest shading on GTIG's map over Malaysia, Brazil and Iraq, and coverage across North America, Western Europe, Turkey, Russia, South Africa, South-East Asia and Australia. Most were Android TV set-top boxes, with others found in telehealth devices, karaoke machines and digital signage.

Why: GTIG says Videostrong built the backdoor deliberately to earn recurring revenue after sale. For advertisers, the case matters because the boxes sat in real homes with household IP addresses, the kind of signal CTV buyers rely on to separate people from fraud, and because the ad fraud modules registered impressions with ad servers and third-party trackers for ads nobody saw. Google estimates that removing the affiliates' C2 domains cuts off at least 10 million more devices, but it has not said how infected boxes already in homes will be cleaned.