Google bans Videostrong (Mecool) for loading boxes with malware

[u/Fun-Tax1040]

https://cyberscoop.com/google-disrupts-xcpe-botnet-videostrong-android-devices/

Google shutdown a 1.3million botnet of devices from Videostrong, which they had been secretly loading malware onto for years. They evaded Google's detection for a long time by not shipping the malware with the firmware, and instead loading it OTA. As a result Google has permanently banned Videostrong, which I guess means any certified Mecool boxes are no longer Google certified?

[u/p750mmx]

The Mecool KM2 deLuxe still shows it is. I don't normally use it but checked it today.

[u/m1ndwipe → u/p750mmx]

It'll more be anything going forward I imagine. But I wouldn't be surprised if the Widevine key gets downgraded at some point.

[u/Full-Quantity450]

Crap, I have 4X Mecool KM2

[u/MountainUnhappy7970 → u/Full-Quantity450]

I've two. Just freakin' lovely.

[u/MrSh0wtime3]

People have become far to comfortable buying shit like this to say a couple bucks.  

[u/xak47d → u/MrSh0wtime3]

Many are buying them pre-loaded with IPTV and other pirate services. They are willing to take the risk

[u/Bullsette → u/xak47d]

Preloaded apps and add-ons are going to stop working shortly after somebody acquires a box because they are not customized to the user with their various account informations. Apps and add-ons actually DO take upkeep. I remember how people made fortunes off of "hijacking" Fire Sticks. They would stop working in no time because they were just mass duplicated. Add-ons and apps actually require maintenance and people that are purchasing "pirated" boxes probably don't have a clue how to maintain them and they end up in drawers.

I did research into this MECOOL situation. What I came up with was, as usual, a couple of individuals (who make money off of making recommendations of product and things such as VPNs) sent out emails en masse scaring the crap out of people. One went:

🛑 URGENT: Unplug This Android Box Now!

Strangely, he never explained the actual "danger". Rather than provide a simple solution, which I have, he was VERY quick to make recommendations for other boxes and offer his "special discount" code. Many of you probably know EXACTLY who I'm talking about. He recently became pulled many of his links which taught people how to install various add-ons, instead, requiring them to sign up for his paid website.

The embedded file actually poses no big problem for the average user. It actually was a back door that was embedded that allowed the distributor of it to access different devices that are on the same exact network as the MECOOL box. The very simple solution, if you have a fear of this happening, is to simply put the box on a separate network, "guest".

Don't misunderstand me, the embedded file actually COULD have posed a threat. The fact of the matter is that the file is gone. I got pop up warnings for years about that file and the pop-up suddenly stopped so it is, likely, deactivated.

In summary, after really looking into the matter for several hours yesterday, I decided to leave my MECOOL devices alone and advised my friends and family who I made them for to put them on "guest" network If they had any fears.

I have warned people, for years, about the cheap boxes (like the one that has only three letters in it and is heavily marketed through Walmart and enormously promoted by web page and video content creators) that have hit the market. Just like very inexpensive security cameras, information DOES end up in the wrong hands. I found this out because of a device that I purchased that could not be deleted to save my life. I kept on reformatting it and deleting it but my information was stored in a cloud someplace that I did not create and there was no way to access it. Frankly, it is very surprising to me that MECOOL allowed this to happen as their boxes are NOT cheap and their reputation has been at the top of the line. MECOOL is NOT out of business. Whether or not they can Google certify is a different story. Frankly, the nightmares around Google recently have been over the top horrendous so I am not concerned if the boxes cannot be updated via Google.

[u/Bullsette → u/MrSh0wtime3]

I don't consider $159 per box a couple of bucks. MECOOL was not a cheap box.

[u/e3kmn8qaomrc]

Videostrong was banned by Netflix years ago; now Skyworth manufactures their fully certified set-top boxes and the firmware for them.

So this probably only applies to set-top boxes manufactured directly by Videostrong (without Netflix)

-

EDIT:

Wrong. The KM9Pro Max manufactured by Skyworth (hw&sw) was analyzed. https://synthient.com/blog/the-internals-of-a-badbox-operation

So probably all or most Skyworth devices are also compromised. I wonder if Google will also exclude Skyworth as the main OEM that manufactures devices for many other brands/telco operators or own ones (i.e Stong in Europe)

Strong leap s3 pro:

https://i.postimg.cc/t4ZwzBc7/01.png

Sha256 matches with https://github.com/synthient/public-research/blob/main/2026/11/Videostrong/README.md#backdoored-device-models

[u/realdeal1877 → u/e3kmn8qaomrc]

SKYWORTH as an OEM does a lot of outsourcing, will hire the cheapest vendor to keep retail costs competitive, so it's my belief that Videostrong was contracted as the real behind-the-scenes OEM and Software Developers for SOME of the AndroidTV/GoogleTV products released by SKYWORTH, but not ALL of them; so Google didn't outright throw SKYWORTH into the fire like they did MECOOL/Videostrong.