One of Google’s Android partners turned 1.3 million set-top boxes into a botnet

Google says it has dismantled a secret backdoor that one of its Android manufacturing partners, Shenzhen, China-based Videostrong Technology Co., embedded in 1.3 million certified set-top boxes, turning them into a botnet used for ad fraud, data exfiltration, and unauthorized network traffic. The company says the backdoor and botnet were intentionally developed, deployed, and operated for financial gain, and it has cut ties with Videostrong, banning the manufacturer from building or selling certified Android devices or supplying software for them. The incident raises supply-chain security concerns for the Android TV ecosystem, where certified partners ship devices directly to consumers. Watch for whether Google discloses remediation steps for affected device owners, any regulatory or legal follow-up, and whether additional partners face scrutiny.