Cheap Android TV boxes came with malware, and Google says the manufacturer was behind it

A new report on compromised streaming hardware is a reminder that a bargain price can come with a hidden cost. A backdoor was discovered in the Firmware of multiple Videostrong devices, such as the Mecool KTI, as well as several white-label Android TV boxes. Google now says the manufacturer itself was behind the malicious code, not an outside attacker who tampered with the devices later. The finding raises uncomfortable questions about trust in the budget electronics supply chain.

What Researchers Found Inside These Budget Devices

According to the report, the backdoor was found in the firmware of several Android TV boxes made by Videostrong. The Mecool KTI is the best-known model named so far, but the same software was also found in a number of white-label products sold under other brand names.

The discovery came from a Seattle-based cybersecurity firm that analyzed the devices and found behavior consistent with a built-in remote access mechanism. Because the code sits in the firmware, it is part of the operating system image shipped on the hardware, not an app a user installed.

That distinction matters. Malware in an app can usually be removed by uninstalling it, but a backdoor in the firmware is far harder to detect and clean, and often survives routine resets.

Why Google Points the Finger at the Manufacturer

The most striking part of the story is Google's position that the manufacturer was responsible. Many earlier incidents involving infected consumer devices were blamed on compromised update servers, rogue resellers, or third-party software added further down the supply chain.

Here, Google's assessment is that the malicious component originated with the company that built the devices. That suggests the code was either added deliberately or introduced with the manufacturer's knowledge, and it is a more serious claim than a simple Security oversight.

How a Firmware Backdoor Actually Works in Practice

A firmware-level backdoor gives its operators a persistent foothold on the device. Once the box connects to a home network, the hidden code can contact remote servers and wait for instructions, with no action needed from the owner.

Depending on the design, such access can be used to download more payloads, change system settings, or route traffic through the device. Owners usually notice nothing, since a compromised box can keep streaming video normally while the malicious activity runs in the background.

The Risks for Households Using Infected Boxes

The most immediate concern is that an infected box sits Inside the home network, alongside phones, laptops, and smart home gadgets. A device with remote access could become a stepping stone for further attacks on other equipment on the same network.

There is also the question of the device's own resources. Compromised boxes of this type are often enlisted in networks that carry out ad fraud, proxy traffic, or other abuse, which can slow your connection and tie your IP address to activity you never authorized.

Why White-Label Products Make the Problem Worse

White-label devices are generic hardware sold under many different brand names. A single manufacturer's firmware can end up in dozens of products, which makes it very hard for buyers to know who really built the box on their shelf.

This also complicates remediation. If a backdoor is traced to one factory, the affected products may carry names most consumers have never heard of, and there may be no clear channel to announce a fix or a recall.

What This Means for Android Certification and Trust

Android TV boxes are supposed to meet certain standards if they want access to Google's services and the Play Store. This case shows that certification alone does not guarantee that a device is clean, especially when low-cost products flow through many channels.

Google has said before that it takes action against partners that violate its policies, and it can limit access to its ecosystem. Still, enforcement is difficult when manufacturers can rebrand products or ship uncertified builds that look similar to legitimate ones.

Steps Owners Can Take to Protect Themselves

If you own a Mecool KTI or another Videostrong-based box, the safest option is to disconnect it from your network until you can confirm it is free of the backdoor. Check the manufacturer's and the researchers' guidance for the specific models affected, and consider replacing the device if no trustworthy firmware is available.

It also helps to isolate streaming boxes on a separate guest network, so they cannot reach computers and phones. Monitor your router for unusual outbound connections, and avoid sideloading apps from unknown sources on any streaming device.

How to Choose Safer Streaming Hardware Going Forward

Buying from well-known brands with a track record of regular security updates reduces risk, even if the price is higher. Look for devices that are officially certified by Google, and check that the seller is reputable rather than an anonymous marketplace listing.

Be wary of products that promise free premium channels or unusually low prices, since such boxes often cut corners on software integrity. A device that does not receive updates should be treated as a long-term liability, not a bargain.

The Bigger Lesson for the Consumer Electronics Industry

This episode highlights a growing problem in the connected device market: the software on a product may be as risky as the hardware is cheap. As more households rely on internet-connected gadgets, supply chain integrity becomes a consumer safety issue, not just a technical one.

Researchers, platform holders, and regulators will likely keep pushing for stronger verification of firmware before devices reach shoppers. Until that happens, the burden falls partly on buyers to be cautious, and the Videostrong case shows why.

As more details emerge, expect further guidance on which models are affected and how to remove the threat. For now, anyone with one of these boxes should treat it as untrusted and act accordingly.

If you have any questions, please don't hesitate to Contact Us