Google bans a TV box maker over a fraud backdoor

SPEAKER_1 (0:00)

This is Marketing Is Calling, the audio edition of Landline, the daily newsletter from PPC Land. It's Sunday, November 8, 2026 This episode is read by an AI voice.

Today, Google bans a TV box maker that built a back door into more than a million devices and sold it to fraudsters. Meta moves users into a single Meta account without asking first. TikTok pitches a two-month Q5. Amazon publishes a culture study and books a Melania series. And Google tests two small changes to search ads that could matter more than they look.

We start with the biggest story of the weekend, which is about ads that nobody saw. On Saturday, November 7, PPC Land reported that Google has removed the Chinese set-top box maker Videostrong from its certified Android program and borrowed it from preloading Google apps. Google's threat intelligence group found that Videostrong built a back door called XPDE into its own boxes and then sold access to criminal groups. More than 1.3 million boxes ended up in a botnet, which Google and its partners took down the week before the report. The language is unusually blunt. Google's researchers wrote that Videostrong put illicit recurring revenue ahead of the safety and privacy of its users and that this wasn't a rogue insider or an oversight. The back door, they said, was intentionally developed, deployed and operated. Usually when devices are compromised, the explanation is a supply chain failure somewhere upstream. Here, Google says the company whose name is on the box was the problem. For advertisers, the important part is how the fraud worked. Some modules fired impression beacons and tracking calls for ads that were never shown. Two of them called Fission and Hidden View recorded ad views without rendering any creative at all. Another tool ran hidden browser windows that scrolled, clicked, typed and played video acting like a person who wasn't there. Those are exactly the signals buyers and verification firms used to decide an impression was real. And the report names no ad network, exchange or advertiser that paid for the traffic. So the uncomfortable question of whose budgets bought these views is still open.

Advertising wasn't even the main business. The bigger money came from residential proxy software, which rents out ordinary home internet connections to anyone who wants traffic that looks like a real household. Some boxes ran up to three proxy kits at once. Infections were heaviest in Malaysia, Brazil and Iraq. And the list of infected devices included telehealth equipment, karaoke machines and digital signs. The scale may be bigger still. Google says shutting down the affiliate servers cut off at least 10 million more devices. And one of its partners called the 1.3 million figure a low estimate. The malicious code arrived after the first boot, which is why Google certification tests missed it. Google says it has changed its review process without saying how. As streaming TV takes a bigger share of media plans, where a device comes from is becoming part of brand safety. Now to Meta.

PPC Land reported that Meta is automatically converting Account Center, the hub that links Instagram, Facebook and Threads profiles, into something called a Meta account. An email sent on November 5 told users the change had already happened and offered no way to say no.

Meta presents it as a convenience, with one login, pass keys and one place for privacy and ad settings, covering Threads, Meta AI and Meta's AI glasses too.

Meta says people can choose which profiles to include. What the notice doesn't say is how the new account fits with European law. In the EU, Account Center is where people decide whether Facebook and Instagram data gets combined, a choice Meta introduced because of the Digital Markets Act. Meta was fined 200 million euros under that law in 2025 and is appealing. For advertisers, the account isn't cosmetic. It's the identity layer that decides which profiles belong to the same person, which shapes frequency, targeting and measurement across Meta's apps. And for regulators who spent years making Meta ask before combining data, an account that combines the apps by default and reports it afterwards is likely to raise questions.

TikTok is trying to stretch the holidays. PPC Land reported that TikTok published a post calling Q5 a golden opportunity, arguing that ad prices fall after the holidays while people keep using the app. Here's the twist. TikTok's playbooks defined Q5 as December 1 to January 31, roughly two months. Meta described a Q5 of about three weeks. The evidence is thin. TikTok's price charts have no vertical axis, no currency and no values. Some figures come from a TikTok survey from September 2023 and one footnote says full-source details are still to be confirmed. TikTok itself says prices could potentially drop. The playbooks are more precise about spending. Daily budgets must be at least 50 times the target bid for app install campaigns, and gaming campaigns need more than three times their usual budget. A two-month Q5 that starts on December 1 overlaps with the most expensive weeks of the year, which turns a post-Christmas sale into a planning category. Amazon ads published a culture study with the consultancy CrowdDNA, surveying 21,600 adults in 12 countries. Its headline finding is that 70% feel society is more divided than ever, and it argues brands can shape culture through shared values. But PPC Land found the report's own numbers don't always match. One figure is 72% in the main text and 66% in the appendix. The country gaps are wide too. Only 33% of Germans agree that advertising helps people learn about other cultures, compared with 77% in the United Arab Emirates. The survey was done between December 2023 and February 2024, and its recommendations point straight to Prime Video, Twitch, Amazon Music and Wondry.