Videostrong Built a Backdoor Into 1.3 Million Android TV Boxes and Sold the Access to Criminals

1,472,554 TV boxes and other Android devices in over 170 countries shipped with a backdoor. The owners did nothing wrong. The maker put it in the firmware, at least since 2020, and sold access to criminals.

On November 2, Google’s threat intelligence team named the company behind the backdoor: Videostrong Technology, a manufacturer in China that designs and builds Android TV boxes for its own brands and for other companies. The team writes with high confidence that Videostrong developed the backdoor, put it on its boxes, turned them into a botnet and ran it for profit, as a deliberate campaign by the company itself. The team calls a device maker that infects its own users on purpose an unacceptable breach of trust. Videostrong then sold access to those boxes to other criminal groups, who paid to load their own software onto them.

The count of 1,472,554 comes from TrendAI, which measured the operation between June and October 2026 and found the backdoor in 206 different models of TV boxes, projectors and other Android devices. Its collection had gaps, so the researchers call that number a lower limit. Most of the devices are in Malaysia, Brazil, Iraq, Mexico and Taiwan. In the United States, Germany, the United Kingdom, Australia and Canada, the count lies between about 26,000 and 42,000 devices per country. Over those four months, 3,849,226 different home and mobile IP addresses showed up as exit points for internet traffic that other people paid to send through these boxes. A second research team puts the number of devices that contact the operators’ servers on any given day at around half a million.

One of the boxes is the MECOOL KM9PRO Max. Its maker announced it on December 5, 2024, as a 4K streaming box certified by Google and Netflix, and pitched it as a Christmas present. At IFA in Berlin in 2025, Videostrong presented itself as a maker of Google certified and Dolby approved devices. That second research team is Synthient, a company that tracks proxy networks, and its researchers bought a KM9PRO Max in late 2025. They switched on developer mode and connected to it over ADB, the Android Debug Bridge that developers use to control an Android device from a computer, on port 5555. Then they dumped the apps and processes that were running. The backdoor was already there, running with system rights under the name com.oemservice.

Before a box may ship with the Play Store on it, its software has to pass a set of compatibility and security tests. Videostrong scrambled its code so the tests could not see what it did, a trick called obfuscation, and the malicious part only loaded after the buyer switched the box on for the first time. The threat intelligence team writes that Videostrong exploited a gap in those tests, and that the review process has been changed because of it.

The backdoor itself is called x.cpe, and in some builds it runs as com.oemservice. It starts as a small starter program, called a stub, in the system part of the firmware, with the same rights as Android’s own system processes, the level Android calls android.uid.system. When the box boots, the stub looks in a separate partition called /oem/ for the full package and installs it into /data/app/. An owner who finds it there and uninstalls it gets it back at the next restart. As a normal user, there is no way to get rid of it.

When the box starts, it sends its device information to a server under anyevonline[.]com. The server answers with login details for a second server that uses MQTT, a small messaging protocol. From that moment the box keeps a connection open to mqtt.szbboys[.]com on ports 3885, 3886 and 3887, and waits for orders. Each check-in message it sends contains information about the device, and also the e-mail address of the user, if someone is signed in on the box.

Before it installs anything, the backdoor wipes the setting on the box that records what the user agreed to. Then it turns off Play Protect, the scanner that checks apps on Android devices. From there it can install apps without asking, run shell commands and scripts, take screenshots of what is on the TV, send key presses to the box and map the network it sits on with ping and traceroute tests. In the four months of counting, silent install commands reached more than 187,000 devices, and the operators could also collect Wi-Fi and Bluetooth data from the boxes.

The money came from what Videostrong let other companies run on the boxes, and the largest part was proxy software. About 1.33 million of the counted devices were lined up to get that extra software, the proxy and ad fraud modules. A residential proxy sells access to home internet connections. A customer pays, and their traffic goes out onto the internet from a living room, with that household’s IP address on it, while the household has no idea.

The threat intelligence report lists modules from Honeygain and NetNut among the proxy providers, plus six more. Next to the proxies came ad fraud modules that load ads in the background and click on them. Four more backdoors came along as well, among them Moyu and Bird, which researchers had seen before in BadBox, an earlier operation built on backdoored TV boxes. The groups behind those modules also had other ways onto devices, and their servers reach at least 10 million more compromised devices on top of the 1.3 million, according to the same report.

Besides TV boxes, x.cpe also turned up on telehealth devices, karaoke machines and digital signs.

The oldest x.cpe sample in the researchers’ published list was first seen on December 14, 2020, as version 3.6.5. In late 2024, Videostrong moved the modules that made the money out of x.cpe and into a separate app called com.abc.nexus, possibly in response to earlier enforcement against those older backdoored boxes. Nexus bundled several proxy programs into one app, and the researchers traced it through a series of versions, with proxy providers added and removed along the way.

In August 2026 the operators changed course again, and Nexus was uninstalled from boxes across the botnet. New packages arrived through the messaging connection, named to look like part of Android: com.android.system.ntp and com.android.sso.auth.handler. Several versions of them unpack a file called libexploit.so. That file restarts adbd, the service behind ADB, with root rights and opens a shell through it. The package then uses that shell to copy itself into /system/priv-app/, and writes a permissions file that lets it install packages and reboot the box. Some of the payloads came from a public code repository called Aviciiii/ott, filled with device images and backdoors, which now returns a 404.

The trail to Videostrong runs through Kimwolf, the botnet I wrote about in January, which reached at least 2 million devices, mostly Android TV boxes with an open debug port, through a hole in a proxy service. While tracking that botnet, the same researchers saw boxes of this kind getting infected, and MECOOL devices were among them. Boxes like these are popular for pirated streams, and together with the Motion Picture Association, the film industry group that fights piracy, the researchers bought several of them to take apart.

Following the servers, the researchers found that the command server anyevonline[.]com has a subdomain, file.anyevonline[.]com on port 8000, with an open directory that was reachable from the internet without a login. Inside were the backdoors the operators used, and a folder named pdf. In that folder was a signed device declaration from Owen Cao, the R&D director of Videostrong. The domain videostrong.cn points to the same IP address as mqtt.anyevonline[.]com, the operators’ admin panel, where they could see their victims and hand out tasks.

The operators signed the backdoors with Videostrong e-mail addresses. In the list of traces the researchers published, the certificate for the over-the-air updates and the certificate that signs the Yoka apps and the CPE app itself both carry the same address, hong.luo@videostrong.com. The threat intelligence report also lists eleven accounts on a code-hosting site that served the operators’ packages, and one of them is called yf-videostrong.

The message server is called szbboys, and Bboys also shows up in the trademark records of the United States Patent and Trademark Office. There, the MECOOL trademark belongs to Shenzhen Bboys Technology Co., Ltd., on the 5th floor of the Lushi Industry Building in the Bao’an 28 District. The same company holds the US trademarks YOKATV and M8S PLUS.

YOKATV used to belong to Videostrong itself, which registered it in 2016. That registration lapsed, and the office cancelled it on August 4, 2023. On November 25, 2023, the MECOOL trademark holder filed for the same name and got it registered in October 2024. Yokatv.com is one of the storefronts where the researchers found the backdoored devices for sale, and M8S_PLUS is one of the model names on their list. Videostrong’s own website gives its address as the 6th floor of the Lushi Industrial East Building, in that same district.

That website now leads with AI companion robots and products for elderly care. The company sells the HC1 Home Care Hub for elderly care and telehealth, with a 1080p camera and two microphones, and it supports MQTT, the same protocol the backdoor uses. Its KA1 is a smart speaker with an Android TV box inside, and its KA2 is a box with a full HD camera, a microphone array, a speaker and Android TV. MECOOL’s own store sells them as the HomePlus KA1 and the Now KA2, the second one as Google certified video calling on TV.

All three model names appear on the list of 182 model names seen in this campaign. The researchers add that a model name on its own does not prove a device is infected, and nothing on that list shows these are the same products. The HC1 product page says Videostrong does not store or share voice, image or video data from its devices.

Last week, Google took the operation down together with Japan’s National Police Agency and five security companies, among them the two research teams named here. Through legal action, it took down the domains and servers Videostrong used to control the boxes and push its modules, along with the command servers of more than a dozen malware families the backdoor loaded onto them. It also cut its ties with Videostrong and banned the company, and any future subsidiary or affiliate, from building certified Android devices or supplying software to other certified makers. Videostrong did not immediately respond to questions from The Register.

The servers are gone, but the backdoor is still on the boxes. It sits in the firmware and puts itself back after a restart, and the owner cannot remove it. The team that counted the boxes says cleaning them needs the vendor or the platform to act, or a new device. The advice from the team that bought the box is shorter: get rid of it, because it may still carry other malware.

The threat intelligence team also points at the shops. Retailers and online marketplaces that sell these boxes share responsibility, it writes, and should demand independent security audits from manufacturers and quickly stop selling devices from the makers caught doing this. The researchers who bought the box go further and want these devices pulled from online stores and marketplaces right away.

To see which box you have, open the settings and look up the model name, then compare it with the list of 182 model names in Synthient’s public research repository on GitHub. With network debugging switched on in the box’s developer options, a computer on the same network can check for the package names from the report:

1
2
3
4
5
6

adb connect 192.168.1.50:5555
adb shell pm list packages oemservice
adb shell pm list packages cpe
adb shell pm list packages abc.nexus
adb shell pm list packages system.ntp
adb shell pm list packages sso.auth

Replace 192.168.1.50 with the IP address of the box. A line that starts with package: means the name is installed. Take a box that shows one of them off the network. Switch network debugging off again when you are done, because an open debugging port on the home network is how the botnet from January got onto boxes like these.

The report gives owners this advice:

• → Keep the built-in app scanner turned on
• → Stay away from apps that pay for unused bandwidth or for sharing your internet connection
• → Buy boxes from brands on the Android TV partner list

On these boxes the first tip does not help, because the backdoor itself sets package_verifier_user_consent to -1, and that switches the scanner off. The box from the start of this story was advertised as Google certified.

Which devices on your own network answer on port 5555, and which one keeps talking to the internet while the TV is switched off?

My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Google Threat Intelligence | Synthient | TrendAI Research | USPTO trademark record