Google’s Threat Intelligence Group published an account on November 2, 2026 of a botnet it calls XCPE: a backdoor that arrived preinstalled in the firmware of more than 1.3 million Android TV set-top boxes. Google says it assesses with high confidence that the malware was developed, deployed and operated for profit by Videostrong Technology, an Android device manufacturer that sold boxes under its own and partner brands.
If you bought a cheap streaming box in the last few years, this is worth ten minutes of your attention. The important part is not the size of the number. It is that a takedown of criminal infrastructure does not clean the device sitting under your television.
What was actually inside the box
This was not malware a user installed by sideloading an app. According to Google and to BleepingComputer’s reporting on the same disclosure, the backdoor components, tracked as x.cpe and com.oemservice, ran with Android system-level privileges and were baked into the firmware image.
From that position the operators could silently install additional Android apps, disable Google Play Protect, run shell commands with system privileges, capture screenshots, log keystrokes, and collect account details, device identifiers, installed-app lists and system logs. Google says the access was then sold to criminal affiliates who used the devices for ad fraud, for residential proxy networks that route other people’s traffic through your home connection, and for loading further malware.
Why certification did not catch it
Android TV boxes that ship with Google apps go through compatibility and security testing. Google says Videostrong used obfuscation to exploit a gap in that process and load malicious code after the device’s first boot, rather than carrying it visibly in the shipped image. Google says it has since changed its review process, ended its relationship with Videostrong, revoked its licence to build Android TV devices with preloaded Google apps, and banned the company and its affiliates from producing certified Android devices.
The lesson generalises beyond one manufacturer: a certification mark describes the software a device was tested with, not everything it will run afterwards.
What the takedown did, and what it did not do
Google says it took down command-and-control domains used by more than a dozen related malware families, working with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. It estimates that severing those domains cut affiliate access to at least 10 million additional compromised devices, including retail set-top boxes, karaoke machines and telehealth hardware, not all of them Android.
What it did not do is remove the backdoor from infected hardware. BleepingComputer reports that the malware remains on affected devices and reinstalls itself from the /oem/ partition if a user uninstalls it. Play Protect may still be switched off. Google’s disruption targets the operators’ reach, not the file on your box.
How to check whether your box is affected
- Identify the exact model. Check the label on the bottom of the box or the model number in Settings, then compare it with the list of affected model names that security firm Synthient published alongside its research. Synthient’s investigation began with a MECOOL KM9PRO Max box, and MECOOL is the brand most associated with the affected hardware, but Google says the malware appeared across multiple brands and models.
- Look at Play Protect. Open the Play Store, tap your profile picture, then Play Protect. If protection is turned off and you did not turn it off, that is a warning sign rather than proof, because the backdoor was designed to disable it.
- Check what has system-level access. In Android TV settings, review device administrators and accessibility services for anything you do not recognise. The backdoor used system privileges, so a normal app list may look clean.
- Treat unexplained behaviour as evidence. Random reboots, apps appearing without installation, unusual network activity while the TV is idle, or a box that runs noticeably hotter than it used to are all worth investigating.
What actually fixes it
There are only two honest options. The first is clean firmware from a source you can trust, installed deliberately, which for most of these boxes means the manufacturer’s own site or a verified community build, and neither is guaranteed to exist for a no-name model. The second is to stop using the box for anything that matters and replace it with a device from a manufacturer with a certified, updatable firmware path.
Unplugging it stops the immediate risk of it being used as a proxy node. It does not make the hardware trustworthy. If the box was on your network and signed into a Google account, change that account’s password, review recent activity through the November 2026 Android security update walkthrough, and check which devices still have access.
One thing not to do: install a random “security fix” APK from a forum or a video description. On a device with a firmware-level backdoor, the fix is more likely to be the next payload.
What we did not do
We did not test, open or scan any Android TV box for this article, and we are not naming any specific model as safe. All technical detail comes from Google’s published report and from BleepingComputer’s reporting, both linked below. The model list and the infection estimate come from the researchers, not from our own measurements.
Sources
- Google Cloud: Shutting the Door on the XCPE Botnet
- BleepingComputer: Google disrupts million-device XCPE Android malware botnet
- Ars Technica: Google dismantles botnet running on 1.3 million Android TV boxes
