Google has cut off an Android TV box botnet called XCPE that ran on more than 1.3 million streaming boxes. Its researchers say the company that made the boxes, Shenzhen-based Videostrong Technology, planted the backdoor on purpose.
The Google Threat Intelligence Group wrote that it has “high confidence” Videostrong ran the botnet “for financial gain.” Google has banned the company from making certified Android devices.
The detail that matters most for owners is that some of these boxes passed Google’s own certification. That breaks the usual advice for spotting a risky box. The checks below go further than “make sure it’s certified”.
A backdoor installed at the factory
The malware was not something owners downloaded. The maker built it into the firmware at the factory, according to Google and BleepingComputer’s Lawrence Abrams, who covered the takedown on November 2.
The main component, called x.cpe and sometimes com.oemservice, runs with Android system-level privileges. If a user uninstalls it, Google says, “it automatically reinstalls from the /oem/ partition upon reboot.”
From there the operators could install apps silently, run commands and capture the screen. They could also switch off Google Play Protect, Android’s built-in malware scanner. Google’s report includes the code that disables those app checks.
Google says Videostrong sold access to criminal “affiliates”, who loaded their own modules onto the boxes. The modules did three jobs:
- Turned the box into a residential proxy, so strangers’ internet traffic ran through the owner’s home connection. Google names Linkfog, AppSalt/Honeygain, NetNut and Traffmonetizer among the proxy tools.
- Ran ad fraud through engines Google calls HiddenView and Fission.
- Installed more backdoors, which Google calls Spirit, Moyu and Bird.
That’s why a box can look fine on the TV while it works for someone else. Buyers’ home connections could carry that traffic without their knowledge, The Register notes.
Google worked with Japan’s National Police Agency to take down the botnet’s control servers. Security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI also took part.
The same affiliates spread their modules through other channels too. So Google expects the action to “sever access to at least 10 million additional compromised devices.” Most are TV boxes, but Google also found infected telehealth devices, karaoke machines and digital signs.
Tens of thousands of the boxes were in the US
Google’s report doesn’t list countries. It describes the botnet only as “globally dispersed.”
Other outlets got the numbers from TrendAI. CyberScoop’s Matt Kapko reported that nearly 44,000 infected devices were in the US between June and October.
The botnet reached more than 170 countries. The biggest clusters were in Malaysia, Brazil, Iraq, Mexico and Taiwan.
The Hacker News put TrendAI’s total at 1,472,554 infected devices across 206 models from June 3 to October 1. By our math, CyberScoop’s US figure is about 3% of that total. The US is a minor market for this botnet, but that still means tens of thousands of American homes.
Only one consumer brand appears on the record so far. Synthient found the backdoor preinstalled on a MECOOL KM9PRO Max it bought in late 2025, according to BleepingComputer.
Plume found more than a dozen devices talking to the botnet’s control server, most of them MECOOL boxes, The Hacker News reports. Synthient has also published a list of 182 model names seen in the campaign.
Google says the backdoor appeared in “many different device models and brands over multiple years.” So a box without a MECOOL logo isn’t automatically in the clear. Videostrong also supplied the firmware and remote-management tools for other companies’ devices, The Hacker News reported.
Why the ‘certified’ label didn’t stop it
The usual advice for Android TV boxes is simple: buy one that Google has certified. The FBI’s June 2025 warning about an earlier botnet, BADBOX 2.0, made the same point. It lists uncertified Android devices as a warning sign.
XCPE broke that rule of thumb. Videostrong was a certified partner.
As of November 2, its website still listed a “Google Certified Android TV Box,” The Hacker News reported. The botnet included both certified boxes and ones running uncertified open-source Android.
Google says the company used obfuscation “to exploit a gap in our tests and load malicious code after the device’s first boot.” In other words, the box looked clean during Google’s testing and changed afterward.
“The XCPE operators constantly evolved its configurations to evade Google’s pre and post-launch detections,” Charley Snyder told CyberScoop. He heads disruption operations at Google’s threat group.
Google says it has changed its review process and tightened firmware checks for certified Android TV devices. It hasn’t said how.
Certification is still worth checking, since Google and the FBI both treat an uncertified box as a red flag. It just isn’t proof on its own.
How to check the box under your TV
Start with the label. Google’s Play Protect certification help page gives the steps. Open the Google Play Store app, select your profile icon, then go to Settings and About.
That shows whether the device is Play Protect certified. Menus on TV boxes vary, so look for the same Play Store settings if the layout differs.
If it says the device isn’t certified, take that seriously. Google’s page says such devices “may not be secure.” It adds that Google apps on them “aren’t real Google apps.”
Next, find the brand and model name, which is usually on the box itself or in the Settings menu. Compare it with MECOOL and with Google’s list of certified Android partners, which doesn’t include Videostrong or MECOOL.
Then go through the FBI’s other warning signs. They include a box that asks you to turn off Play Protect, or one sold as “unlocked” for free content. Apps from unofficial marketplaces, an unfamiliar brand and unexplained internet traffic are on the list too. The FBI says one sign alone doesn’t prove anything.
Finally, check for apps that pay you to share your connection. Google warns consumers to be “extremely wary” of anything offering money for “unused bandwidth” or “sharing your internet.” Google also says most devices become proxies silently, with no consent asked, so a clean app list proves little.
What to do if your box looks suspect
A factory reset won’t reliably fix this. Google and BleepingComputer both say the backdoor lives in a protected part of the firmware and returns on reboot.
Plume still recommends a full reset, because the add-on modules may have installed other backdoors. It doesn’t say a reset removes x.cpe itself.
The options BleepingComputer lists are installing clean firmware or disconnecting the box from the internet. Synthient goes further and tells consumers to throw the boxes away, The Hacker News reported.
For most people, the practical answer is to unplug the box and take it off your Wi-Fi. Replace it with a streaming device from a major brand that still gets updates. Our guide to the Broadcom Wi-Fi flaw in home routers covers other router settings worth checking.
The FBI asks anyone who thinks a device has compromised their network to report it at ic3.gov. For how to tell real threats from hype, see our explainer on the “Black October” hacks.
Videostrong did not immediately respond to questions from The Register’s Jessica Lyons. With the control servers down, the next test is whether the operators rebuild. They have adapted before. Since August 2026, Google says, they have pushed new droppers disguised as Android system apps.
