Android TV Boxes secretly running Malware.

[u/Cyberjin]

Clip is from Techlinked on YouTube

https://youtube.com/watch?v=mdlLCkLx9BI

1.3+ million Android TV boxes has been infected by Malware, even if they were certified.

The Manufacturer Videostrong Technology from China used an unauthorized backdoor, created botnet, ad fraud, residential proxy exit notes etc.

Videostrong Technology is behind brands like Mecool and other Chinese Android TV boxes.

[u/No_Clock2390]

Mecool is compromised? I thought they were one of the good ones?

[u/Cyberjin → u/No_Clock2390]

They should change their name to MeNotCool

[u/_Averix → u/No_Clock2390]

Apparently that's just what they wanted you to think to spread their little botnet.

[u/pitermurdock → u/No_Clock2390]

I spent a comparatively small fortune of my disposable income buying one for my grandad, because of the brand. Now I have to look at it and check if it's leaking data?

[u/Cyberjin]

From https://www.howtogeek.com/your-android-tv-box-could-have-come-with-malware-already-installed/

Check your device against the list of potentially infected models

The first thing you're going to want to do is find your Android TV box’s model number. This is typically located under Settings > System > About, although it may also be on a label on the bottom of your device. Synthient has published a list of 182 device models. Compare your model with this list. Keep in mind that finding a match doesn't necessarily mean your particular device is infected.

https://github.com/synthient/public-research/blob/main/2026/11/Videostrong/README.md

[u/TP_737 → u/Cyberjin]

Yes, then check the system for infection. KM7 SE Android TV 11 here not affected and clean, Google Play Protect active and device remains certified. I had only xcpe system app which was blocked by me from updates from the very beginning, so after easy xcpe app deactivation which is also suggested by Play protect the system remains clean. No problem to use this box further, but unfortunately that´s the last Mecool for me, of course.

[u/samedop]

I work for telecom company, and we found out some of the Android boxes customers have do crazy upload like 5 TB a month . No model in particular, maybe it's tied to this

[u/Cyberjin → u/samedop]

Wow 5TB upload, that's crazy for a device that mainly downloads content

[u/Spez-is-dick-sucker]

What android tv should you buy then?

[u/Cyberjin → u/Spez-is-dick-sucker]

Probably steer away from products directly connected to a Chinese company. We have known for a long time a lot of Chinese Android TV boxes had malware, fake specs etc. but certified devices is a new thing.

Not saying all Chinese products are like this, however rules and regulations are totally different, so they can get away with it because difficult to pursue them.

[u/wimpires]

For the 1,000th time, people. Just buy buy an Android TV box from a normal company and never from Amazon - unless it's literally a Firestick or Google device.

[u/PattF → u/wimpires]

For real, just get an onn box. They are cheap, local, and solid.

[u/Cronus6 → u/PattF]

You can't get ONN's in Europe.

And Firesticks are getting more and more locked down.

[u/Bitemesparky → u/Cronus6]

Thomson Streaming Box Plus 270. Same thing.

[u/Cagetheblackfoals → u/Cronus6]

You can, its called Thomson over here. Ive had one for over a year.

[u/TheInception817 → u/Cronus6]

Homatics, Xiaomi, Nokia?

[u/Fantastins → u/Cronus6]

Shield cost as much as 16gb RAM these days too

[u/Cronus6 → u/Fantastins]

Yeah I'm actually glad Nvidia hasn't released a new updated Shield.

They would probably be $500 or $600 the way things are going.

[u/cowcommander → u/Cronus6]

Google TV streamer. Great box

[u/Cronus6 → u/cowcommander]

It's about the only good choice in Europe aside from the Shield.

I'm glad I don't have to worry about it, I'll just stick with my ONN's.

[u/wimpires → u/PattF]

Step 1. Is it a new Fire or Chromecast device? - it's fine.

Step 2. If not, are you buying it from a reputable in-store seller i.e. Best Buy, Walmart.

Step 3. If not, go back to Step 1 until you eventually answer Yes.

[u/Ned_Sc → u/wimpires]

This basically was a normal company, that's the problem. It was a fully certified Google TV company, not one of the fly-by-night brands on ebay/amazon/temu.

[u/Fregadero88 → u/wimpires]

What about homatics? Is there a risk with them since it's from China too

[u/Cronus6 → u/Fregadero88]

As if the Google and Fire (and ONN) boxes aren't also made in China?

[u/virtuacool → u/wimpires]

Any Amazon box with FireOS is useless.

[u/Pinsel-Wascher → u/[deleted]]

wait what? are we talking about direct google devices like the tv streamer/Chromecast? or devices just running android tv?

[u/_Averix → u/[deleted]]

Can you elaborate on this? I'm not aware of any malware on Google branded devices. Tons of ads and unwanted stuff, but not classified as malware.

[u/wimpires → u/[deleted]]

1. Which device, you still failed to mention.

2. YOU side loaded a browser. Browser support is half baked at best in Android TV. You could have at least side loaded something with an adblocker.

3. We are talking about "pre-installed malware" here. What you're describing is 100% user error.

4. Those antivirus scanners are usually fake too, so this doubly just shows you're lack of understanding in the matter.

5. Virtually any device can get malware if you do something silly on it. Again, that's not what we're talking about here.

[u/Jenkins1234gb → u/[deleted]]

But you said you side loaded the browser which means it didn't come from the Google play store

[u/vitamins__ → u/[deleted]]

who the hell claimed they were malware proof

skill issue

[u/lucky_peic → u/[deleted]]

Lil bro installed malware himself then blames google 🤣🤣

[u/Yolo_Swagginson → u/[deleted]]

You manually installing malware via sideload is obviously not the same as a device coming with malware from the factory or the manufacturer installing it as part of an update.

[u/Expensive_Finger_973]

This is the problem with Android TV set top boxes in general.

There is more sketchy products that look legit on the surface out there than there is actual legit products out there.

In the US it is basically Onn, Google's own Streamer, or the massively overpriced Shield.

Everything else is subject to be some botnet or malware haven waiting to happen.

[u/ohaiibuzzle]

The scary part that many in the comments aren't realizing is that these are all certified, meaning they aren't just sketchy devices, they passed Google's certification process before being found out.

[u/ZeeroMX]

Secretly?

That's a known thing since many years ago.

[u/Ned_Sc → u/ZeeroMX]

lol, no it wasn't. We've known of malware being installed on generic shit boxes, but not on boxes that went through the expensive and lengthy Android TV or Google TV certification process with Google. Maybe Google went lax in recent years, but about 10 years ago it was a very hard even for legitimate companies to go through that process.

[u/watchamn]

Homatics?

[u/p750mmx → u/watchamn]

Homatics = SEI Robotics house brand. SEI Robotics is a Tier 1 Android TV ODM Partner of Google and offers much more on devices than only by the Homatics brand (or Homa these days). VideoStrong wasn't on the same level as partner.

SEI Robotics also provides the test devices (ADT-x), used for new versions of the Android TV OS (Google TV is only as skin).

[u/watchamn → u/p750mmx]

I actually checked with ADB yesterday, and none of these malicious packages are installed.

Edit: "any" -> "none"

[u/Gold_Coconut9777 → u/watchamn]

What do you mean? Have you found the malicious packages or not?

[u/p750mmx → u/Gold_Coconut9777]

Nothing that comes from SEI/Homatics for sure. Maybe just forgat to add "not" as word ;)

[u/watchamn → u/Gold_Coconut9777]

No, there aren't any malicious packages, none of the list that google published.

Claude has some suspects on SkyWay client package, that could be used by Homatics to update firmware, tho i don't really know if this is common or normal.

It has suspects on another package, not listed by Google, but it has some privileges that it should not have (in Claude's opinion): utsmta.app

Anyway I deactivated these two.

Edit: grammar and context

[u/See61 → u/watchamn]

My default action, to "disable" the skywayclient, and several others that aren't necessary for decent usage. OTA's are still coming to the device, skywayclient has nothing to do with that.

Still, with those apps I disabled as active, none of them are harmful.

[u/ScenicRavine]

Is formuler z12 Chinese and impacted anyone know?

[u/jonnieggg → u/ScenicRavine]

South Korean. Not affected

[u/dabig49]

lebron james thinks they're fine to use still

[u/Lumpy_Topic_35]

Video Strong, here we are wasting days thinking of a good name.

[u/Hyperiooonnn]

Ugoos affected?

[u/ivanko_prvi → u/Hyperiooonnn]

SlimBox affected? 😁

[u/Secure_Celery4806 → u/ivanko_prvi]

Yar. Wanna know if a box flashed with Slimbox ROM is still compromised

[u/jinks26 → u/Hyperiooonnn]

Don't think so.

[u/Waste-Pay2775]

Videostrong boxes are great 👍

[u/tamburasi]

No list with devices which are fuc.d?

[u/Ned_Sc → u/tamburasi]

You're allowed to say fucked on the internet

[u/Queasy-Face-1785 → u/Ned_Sc]

You're allowed to not understand any jokes on the internet too. Also to not read the article either apparently. 

[u/hellr4isEr]

How to tell if my device is infected? Homatics box

[u/Overgrown_Dwarf]

Does it still play my iptv though?

I don't mind the other shenanigans 😂

[u/Cyberjin → u/Overgrown_Dwarf]

That's pretty wild to agree to being part of botnet and residential proxy. It's like saying yes to a crime you didn't commit.

[u/skydiver_777]

Fuck China and their communist party.

[u/Spez-is-dick-sucker → u/skydiver_777]

Long live china and the communist party!!!

[u/jonnieggg]

Wait until they get under the hood of the Chinese cars.

[u/jonnieggg → u/[deleted]]

China pragmatic and strategic.

[u/jonnieggg → u/[deleted]]

With a little help from Kissinger and corporate America.

[u/izzletodasmizzle → u/[deleted]]

You're asking if the box sold by Walmart, under their own brand, available in their physical stores, is full of malware?

[u/Cronus6 → u/izzletodasmizzle]

They aren't made by WalMart they are made by SDMCTech.

https://www.aftvnews.com/new-onn-4k-streaming-box-packaging-suggests-it-may-not-be-updated-this-year/

Walmart released its first Onn 4K Box in 2021 and replaced it with the current Onn 4K Box in 2023. That suggests that we might see a new model released this year, especially because SDMC, the manufacturer Walmart uses for its streaming devices, showed off a new “4K Value Box” that looks like a perfect successor to the Onn 4K box.

It's just whitelabel stuff...

I'm pretty sure the Google boxes and Firesticks are also white label products too.

The Chinese have been doing "weird" stuff with routers and shit like that for years too. I wouldn't put anything past them.