Google Says a TV Box Maker Built a Botnet Into Its Own Boxes
Google says Videostrong put a backdoor called XCPE into more than 1.3 million set-top boxes, then sold access to criminals. The company is now banned from making certified Android devices. The backdoor itself is still in the boxes.
The box under the television was not just playing shows. According to Google, it was also working for someone else.
On November 2, Google's Threat Intelligence Group said it had dismantled XCPE, a backdoor built into the firmware of Android TV set-top boxes. More than 1.3 million boxes were enrolled in the botnet, Google said. The overwhelming majority were set-top boxes. A smaller number were other Android devices, including telehealth devices, karaoke machines, and digital signs.
Google's assessment, stated with high confidence, is that the backdoor was built deliberately by Videostrong Technology Co., a Shenzhen company that makes Android TV boxes under its own name and for other brands, including MECOOL. Google said Videostrong sold access to criminal affiliates and loaded their malware onto the boxes. The affiliates used the boxes for ad fraud and as residential proxies, routing other people's internet traffic through owners' home connections. Google said the campaign was not a rogue employee or a development oversight. It said the code was built into many models and brands over several years.
How it stayed hidden
The backdoor, called x.cpe and in some builds com.oemservice, ran with system privileges inside the firmware. Google said Videostrong hid the code to exploit a gap in its compatibility and security tests, loading the malicious code only after a device's first boot. Delete it, and it came back on reboot, reinstalling from a protected partition. It could also switch off Google Play Protect checks, which let it install more software without asking. Since August 2026, operators had also pushed droppers disguised as system apps.
Independent researchers reached the same conclusion. Synthient, which worked on the takedown, bought a MECOOL KM9PRO Max and found the backdoor preinstalled. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1, and called that figure a lower bound. Malaysia, Brazil, Iraq, Mexico, and Taiwan had the highest counts. The United States, Germany, Britain, Australia, and Canada each had roughly 26,000 to 42,000.
What the takedown does and does not do
Google said it took legal action to seize the domains and servers used to control the botnet, and the command domains of more than a dozen malware families loaded through it. Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI worked on the operation. Google said shutting down the affiliates' command domains should cut criminal access to at least 10 million additional compromised devices, which were infected through other routes. That figure is separate from the 1.3 million XCPE boxes.
The takedown cut the strings. It did not remove the backdoor. Google said owners cannot strip it out themselves, and TrendAI said cleanup needs vendor action, platform protection, or replacement of the device. Google has cut ties with Videostrong and banned the company, and any future subsidiaries or affiliates, from building certified Android devices or supplying software to certified vendors. It said it has tightened firmware integrity checks for certified Android TV devices and changed its review process. As of November 2, Videostrong's website still listed a "Google Certified Android TV Box" and a "Google Certified Android TV Stick," The Hacker News reported.
The practical point is plain. A certified badge on the box did not mean the box was clean. The infection arrived before the box reached the living room. It was in the firmware, shipped from the factory.
