JP — ITmedia

Chinese Manufacturer Allegedly Installed Criminal Backdoor on Android Devices Before Shipment; Google Cuts Ties

SecurityNovember 4, 20262 min read

Google says a Chinese device maker put a hidden backdoor into Android TV and set-top box devices before they shipped, and then sold access to criminals. Google cut ties with the company and worked with police and security groups to shut the network down.

What happened

Google said on November 3, 2026 (US time) that more than 1.3 million devices, mostly Android TV set-top boxes, came with hidden bad software. Criminals used it for ad fraud and for routing illegal internet traffic. Google says the Chinese maker Videostrong Technology built the bad software in on purpose to make money. Google stopped working with the company and banned it from making Google-certified Android devices or supplying software to other certified makers.

Key facts

More than 1.3 million devices were affected.
The bad software is called x.cpe. It was installed when the devices were made.
Videostrong built a botnet (a network of hijacked devices that one person controls) called XCPE.
Google expects its action to cut attackers off from at least 10 million more devices infected through other routes.

How the bad software worked

The software was designed to slip past Google's security tests when a device was certified. It loaded harmful code only after the first startup. If a user deleted it, it came back after a restart. It could also turn off Google Play Protect, the built-in security feature. The attackers could take screenshots, send key presses, and collect account information and system logs.

How the infected devices were used

Videostrong sold access to its backdoor to outside groups linked to crime. The buyers then installed their own bad software. The most common use was as a residential proxy. This means a stranger's internet traffic was sent through the victim's home connection without the owner knowing. One device had up to three proxy programs installed. Some devices were also used to inflate ad views, and extra bad software was added to them.

Why it matters

This story shows that a device can be unsafe even when it is brand new. Many people trust TV boxes and do not check them. Hidden access like this can be used for crime, and the owner may never know. Google says it will now check certified Android TV firmware (the built-in software that controls the hardware) for bad code.

Glossary

Android: A phone and TV operating system made by Google, used by many device makers.
x.cpe: The name of the bad software found in the devices. It acts as a backdoor.
Videostrong Technology: A Chinese OEM/ODM maker in Shenzhen that builds devices for other brands.

Muji's MUJI Card Full Card Numbers, About 1.09 Million Records Possibly Leaked in Unauthorized Access Follow-Up

Ryohin Keikaku said credit card information, names, and addresses that it had initially excluded may also have been accessed by outsiders in the unauthorized access to its MUJI app. Newly identified data includes about 1.09 million member records for the MUJI Card, covering full card numbers, MUJI Card IDs, and birth dates, of which about 345,000 cards remain valid.

Security전자신문Nov 4

Tilon's Dstation X Obtains NIS Security Function Verification Certificate, Clearing Public-Sector Adoption Requirements

VDI company Tilon said its next-generation platform Dstation X (v10.0) has received a security function verification certificate from the National Intelligence Service under its security function testing system. With this, Dstation X has completed quality certification, a procurement channel on the Digital Service Mall, and security verification required for public-sector adoption. Agencies adopting the product can skip the separate security conformity verification process.

SecurityITmediaNov 4

Denny's App Hit by Unauthorized Access; Fraudulent Credentials Created During Legacy App Migration, Possible Personal Data Leak

Denny's Japan announced on November 3 that its app, which manages coupons and points for its restaurants, was accessed by a third party and that some users' personal data may have leaked. During a system process to migrate from the old app to the new one, unauthorized credentials were created, giving access to some users' accounts; the number of affected people is still under investigation. The company says it does not hold names, addresses, phone numbers, passwords, or credit card information.

Securityheise onlineNov 4

Sabotage of Cooling Systems: Expert Criticizes Manufacturers

After cyberattacks on supermarket refrigeration systems in several European countries, including Germany, IT security expert Christoph Fischer of Karlsruhe places primary responsibility on manufacturers of networked devices, calling the delivery of control systems with unchanged factory settings and default passwords "completely unforgivable." He says manufacturers should configure systems so that individual passwords must be set at first commissioning, and that secure remote access via certificates and asymmetric encryption is technically feasible. Fischer also warned against limiting the problem to grocery retail and urged that verification of IT security be added as a criterion in consumer tests.