If your home, shop, hotel or office uses a low-cost Android TV box for streaming, this story is for you. Google and a group of security partners have taken down a botnet called XCPE (also written x.cpe) that was hiding inside the firmware of more than 1.3 million Android TV streaming boxes. The takedown cuts the criminals off from those devices, but it does not clean them. Here is what happened and what you should do.

Key takeaways

• Google says the XCPE backdoor was built into TV box firmware at the factory, not installed by users or spread through a software bug.
• Google attributes the botnet with high confidence to Shenzhen-based device maker Videostrong Technology Co., and has banned the company from making certified Android devices.
• The command servers are down, but the backdoor remains on infected boxes and reinstalls itself if removed.
• Researchers advise reflashing with clean firmware, disconnecting, or replacing affected boxes, and keeping smart devices on a separate network.

What happened

On 2 November 2026, Google’s Threat Intelligence Group published details of a coordinated disruption of the XCPE botnet. The servers that controlled it lost contact with infected devices in late October. Google worked with Japan’s National Police Agency and the security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI (Trend Micro’s enterprise unit). Google also used legal action to take down the botnet’s domains and servers.

The scale is large. TrendAI counted 1,472,554 infected devices across 206 models between 3 June and 1 October 2026, and believes the real number is at least that high. The countries with the most infections were Malaysia, Brazil, Iraq, Mexico and Taiwan, and the US, Germany, the UK, Australia and Canada each had tens of thousands. Google also took down the control servers of more than a dozen other malware families that had been loaded through the backdoor, which it expects will cut criminals off from at least 10 million more compromised devices, including retail set-top boxes, karaoke machines and telehealth hardware.

How the backdoor worked

Built in at the factory

According to Google, the backdoor was placed in the device firmware during manufacturing. Its main parts ran as Android system apps with system-level privileges, which meant ordinary users could not uninstall them. When a box started up, the malware contacted a control server, collected login details for a messaging service, and then waited for commands.

What the operators could do

Researchers say operators could quietly install apps, turn off Google Play Protect’s app checks, run commands, capture screenshots, send keystrokes, copy account and device details, map the local network and open remote command shells. In other words, a box sitting next to your TV could act as a foothold inside your home or office network.

Selling your internet connection

Most of the add-on modules turned infected boxes into residential proxies. That means criminals sold access to the owner’s home or office internet connection so that other people’s traffic, possibly including fraud, appeared to come from that address. Other modules carried out ad fraud by faking views, and some dropped additional backdoors.

Why Google blames the manufacturer

Google says it does not believe this was a rogue employee or an accident. Researchers found that the backdoor passed settings to other Videostrong apps, that a Videostrong domain shared an IP address with the botnet’s control infrastructure, and that a document signed by the company’s research and development director sat on a botnet server. Synthient bought a MECOOL KM9PRO Max box in late 2025 and found the backdoor preinstalled. Plume found that Videostrong supplied both the firmware and remote management tools for affected devices.

In response, Google ended its relationship with Videostrong, revoked its licence to ship devices with Google apps and services, and banned it and any future affiliates from building certified Android devices or supplying software to certified makers. Google says Videostrong hid its code and loaded it after first boot to get past certification testing, and it has changed its review process and is tightening firmware checks as a result. Reports note that the botnet included both certified and uncertified devices.

Who is affected

Synthient has published a list of 182 model names linked to the backdoor, with much of its research focused on MECOOL-branded boxes. It warns that a model name alone does not prove a specific box is infected. Published country figures do not cover African markets in detail, so the absence of Nigeria or other African countries from the top of the list should not be read as a sign that boxes sold here are safe. If you bought an inexpensive, unfamiliar-brand Android TV box from a market stall, a reseller or an online marketplace, it is worth checking.

Why businesses should care

Many shops, bars, hotels, clinics and offices plug cheap streaming boxes into the same Wi-Fi network as their point-of-sale terminals, laptops and printers. A compromised box on that network can scan other devices and relay criminal traffic through your business internet line. TrendAI also points out that consumer devices on remote workers’ home networks are part of an organisation’s attack surface.

Will a factory reset fix it?

Probably not on its own. The backdoor lives in a protected part of the firmware and reinstalls itself after deletion or restart. Plume recommends a full factory reset because extra modules may have added other backdoors, but it does not confirm that a reset removes XCPE itself. TrendAI says clean-up needs vendor action, platform protection or replacement of the device. Synthient goes further and advises consumers to throw affected boxes away.

What you should do

1. Identify your boxes. Note the brand and model of every Android TV box, streaming stick or smart display in your home or business. Compare them with Synthient’s published model list, especially if you own a MECOOL-branded device.
2. Disconnect suspect devices. If a box appears on the list or comes from an unknown brand with no clear update history, unplug it from the internet until you decide what to do.
3. Reflash or replace. Only install clean firmware from a trustworthy source. If none is available, replace the box with a device from a well-known brand that receives regular security updates.
4. Separate smart devices. Put TVs, streaming boxes, cameras and other smart gadgets on a guest or separate network, away from computers, POS terminals and file storage.
5. Block known bad addresses. IT teams can use the indicators in Synthient’s report to look for affected devices and block the listed control domains and IP addresses at the firewall.
6. Buy carefully next time. Before buying a streaming box, check whether the maker publishes security updates. A very cheap box with no update history can cost you far more in the long run.

Sources

• BleepingComputer: Google disrupts million-device XCPE Android malware botnet, bans TV box maker
• The Hacker News: Google disrupts 1.3 million-device botnet

Featured image: Photo: “TV, Television and remote controller – stock photo” by espensorvik, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications