 |
| AI-generated illustration of an Android TV streaming box in a living room, with hidden malicious network connections spreading from it to other household devices. |
Most malware stories start with a bad download or a clicked link. This one starts at the factory. On 2 November 2026, Google announced that it and a coalition of security firms and law enforcement had disrupted XCPE, a botnet built from more than 1.3 million Android TV streaming boxes whose manufacturer, Google says, deliberately hid a backdoor in the devices it sold. The owners of those boxes did nothing wrong. They plugged in a cheap box to watch television, and the box quietly went to work for criminals.
That is the part worth sitting with before the details. This was not a vulnerability that a company missed and then patched. Google's Threat Intelligence Group says, with high confidence, that the backdoor and the botnet were intentionally developed, deployed and operated for financial gain by Shenzhen-based Videostrong Technology Co., and that the company sold access to criminal affiliates who then ran their own schemes through people's living rooms. It is an important distinction, and also one that needs a caution: this is Google's assessment, corroborated by an independent security firm's investigation, not a court ruling. Videostrong did not respond to press inquiries about the claims. What follows is what Google and its partners have reported, and where the reporting itself flags uncertainty.
As an Amazon Associate, we earn from qualifying purchases.
Prices and savings can change. Check the retailer for the current price.
What happened
XCPE is the name researchers gave to a backdoor, tracked as x.cpe and com.oemservice, that was built directly into the firmware of Android TV set-top boxes. Unlike most botnets, which spread by exploiting a flaw or tricking a user into installing something, XCPE arrived with the product. Google says Videostrong had been developing and distributing the malware across multiple device brands and models for years, changing its shape to dodge detection and to serve different criminal affiliates.
The scale is what made the announcement a top security story on 2 November. More than 1.3 million devices were enrolled in the botnet, according to Google. The overwhelming majority were Android TV boxes, but Google also found the backdoor in other Android-based internet-of-things devices, including telehealth devices, karaoke machines and digital signage displays. A separate telemetry count from TrendAI, one of the partners in the takedown, put the figure at 1,472,554 infected devices across 206 models. The two numbers measure different things and should not be mixed up: Google's 1.3 million is the headline count for the XCPE backdoor itself, while TrendAI's count comes from its own network observations.
The takedown itself was a joint operation. Google says it worked with Japan's National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI, and took legal action against the domains and servers used to run the botnet and against the command infrastructure of more than a dozen related malware families. Google says that action will sever criminal access to at least 10 million additional compromised devices. Read that number carefully: those 10 million devices were compromised through other routes and other malware families, not through XCPE itself, and the claim is about cutting off the criminals' access to them, not about cleaning them. The 1.3 million XCPE boxes are a separate, harder problem, as explained below.
How the backdoor worked
The backdoor ran with Android system-level privileges, the highest level on the device, and it was designed to survive. After an infected device started up, XCPE contacted a command-and-control server on the anyevonline.com domain to obtain connection details and credentials for an MQTT message broker, hosted at mqtt.szbboys.com, through which operators sent commands and pushed out additional software. From there, operators could remotely control the device and, according to Google:
- Silently download and install additional Android applications.
- Disable Google Play Protect, the device's own app-safety checking.
- Execute shell commands and scripts with system privileges.
- Capture screenshots and inject keystrokes.
- Collect account information, device details, installed application lists and system logs.
- Conduct network reconnaissance and open reverse shells into the home network.
The business model was access. Rather than running one scam itself, the backdoor acted as a platform that criminal affiliates could rent. Their modules turned infected boxes into residential proxies, routing other people's internet traffic through victims' home connections without their knowledge, using services Google named as Linkfog, AppSalt and Honeygain, GaGaNode, NetNut and Traffmonetizer. Other modules committed advertising fraud by generating fake ad impressions, loading hidden webpages and clicking advertisements. Some installed further backdoors, including Moyu, Spirit and Bird, to download and execute still more malware.
The malware kept evolving. Google says that in late 2024 Videostrong began using a separate loader, com.abc.nexus, to run the malicious modules while XCPE handled communications. Since August 2026, the operators had been replacing that loader with smaller, specialised droppers disguised as Android system applications, using a privilege-escalation exploit to write into the system partition and make themselves harder to remove. Google also says Videostrong used obfuscation techniques to evade security testing and to load the malicious code only after a device's first boot, exploiting a gap in the certification review process that Google says it has since tightened for certified Android TV devices.
How researchers traced it to Videostrong
The attribution rests on two parallel investigations that reached the same conclusion. Google's Threat Intelligence Group published its report on Monday 2 November, stating its high-confidence assessment that Videostrong deliberately built and operated the backdoor for profit, and ruling out the innocent explanations. "We believe this campaign wasn't an isolated rogue insider or a development oversight," Google said.
Separately, cybersecurity firm Synthient published a coordinated report explaining how it traced the backdoor to Videostrong after discovering the malware preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025. Synthient found a publicly accessible directory on the malware's file.anyevonline.com server that hosted backdoors used by the operators, including a folder of documents containing a PDF by Owen Cao, Videostrong's research and development director. Researchers also found that Videostrong's videostrong.cn domain pointed to the same IP address as the mqtt.anyevonline.com command server, and that numerous Videostrong company email addresses had been used to sign the backdoors. MECOOL is Videostrong's own consumer brand, according to coverage of the takedown, and the company also builds devices for other labels, which is why the backdoor turned up across many different brand names.
That breadth is also the biggest practical unknown. Google has not published a complete list of affected brands and models, and Synthient's published list of 182 model names seen in the campaign comes with an honest caveat: a model name appearing on a list does not by itself prove that a particular unit is infected. Anyone selling you a definitive "is my box infected" checker based on the model name alone is overstating what the evidence supports.
What the takedown does, and what it does not do
This is the part of the story most likely to be misunderstood, so it is worth stating plainly. Taking down the command servers disrupts the botnet's operations. It does not clean the infected devices. Google and its partners are clear on this: the malware has not been removed from infected devices, and it reinstalls itself from the protected /oem/ partition if it is removed by ordinary means. A factory reset has not been confirmed by any source to remove it either.
That leaves owners of affected boxes with two realistic options, according to BleepingComputer's summary of Google's findings: install clean firmware from a trustworthy source, which is a technical job most owners should not attempt without expert help, or disconnect the affected device from the internet to stop further malicious activity. Simply deleting a suspicious app, or running a standard antivirus scan on the box, will not solve a backdoor that lives in the firmware and reinstalls itself on reboot.
Google's other actions are about the company, not the devices. It has terminated its relationship with Videostrong, revoked the company's licence to manufacture Android TV devices with preloaded Google apps and services, and banned Videostrong and its future subsidiaries and affiliates from producing certified Android devices or supplying software to certified vendors. As of 2 November, Videostrong's own website was still advertising "Google Certified" boxes, according to coverage of the announcement, which shows how slowly a ban on paper turns into a change on a sales page.
How to tell if your box is at risk
There is no single test an ordinary owner can run, but the risk factors are clear enough to act on. Work through this checklist:
- Did you buy a cheap, no-name or little-known Android TV box, especially one sold under the MECOOL brand or another budget label, rather than a box from a major manufacturer or your internet or TV provider? Those are the devices at the centre of this campaign.
- Is the box an Android TV set-top box, rather than a television with Android TV built in by a major TV brand, or a mainstream streaming stick from Google, Amazon, Apple or Roku? The infected population is overwhelmingly separate set-top boxes.
- Does the box show unexplained behaviour: apps you did not install, unusually high data usage, sluggish performance, or advertising appearing where it should not? None of these proves infection on its own, but together with a budget box they raise the suspicion.
- Can you find a firmware update from the manufacturer, and does the manufacturer's name trace back to Videostrong or an unknown Shenzhen vendor with no real support channel? A missing or dead support channel is itself a warning sign.
- Is Play Protect disabled, or does it refuse to stay enabled? XCPE deliberately switched off Play Protect, so a device that keeps losing its protection setting deserves a closer look.
If none of these apply, and your streaming device comes from a major brand with regular updates, this particular botnet is unlikely to be your problem. If several apply, treat the box as suspect even though no list can confirm it.
What to do if your box is affected
- Disconnect the box from the internet first. This is the fastest way to stop it being used, and it costs nothing.
- Change the passwords for any accounts you used on that box, and for your home Wi-Fi network, from a different, clean device. The backdoor could collect account information and system logs, so assume credentials entered on the box may have been exposed.
- Do not try to "clean" the box by deleting apps or factory-resetting it and then reconnecting it. The backdoor reinstalls itself from a protected partition, and a reset has not been confirmed to remove it.
- Do not install firmware from random download sites. Unofficial firmware is a classic way to replace one backdoor with another. Only use firmware from the device's legitimate manufacturer, and if none exists, treat the box as disposable.
- If you cannot get trustworthy clean firmware, stop using the box and replace it with a device from a major brand or your service provider. A cheap box that spies on your network is not a bargain.
- Check your other devices on the same home network for unusual behaviour, and keep your router's firmware updated. The backdoor could open a way into the home network, not just the box itself.
- Report the device to your country's consumer protection or cybercrime reporting service if you believe you bought an infected product. Reports like this one only happen because researchers and buyers flag suspicious devices.
Why this matters beyond one brand
XCPE is not an isolated curiosity. The Register notes that the operation sits in the same ecosystem as BadBox 2.0, another notorious botnet that infected more than 10 million TV boxes and other devices before Google, HUMAN and TrendAI disrupted it in March 2025. The pattern is now familiar: cheap hardware, sold at prices the big brands cannot match, subsidised not by the sale but by the secret resale of the buyer's own device and internet connection.
That pattern is a warning about what "certified" means and how much it can be trusted. Google's certification programme exists precisely so that buyers can tell a legitimate Android TV device from an unknown one, and Videostrong allegedly abused that trust by hiding its code until after the device's first boot, past the point where certification testing would catch it. Google says it has changed its review process to close that gap, and has tightened firmware integrity checks for certified Android TV devices. Whether that is enough will be judged by whether a third such botnet appears, not by the announcement.
It is also a warning about the economics of the bargain shelf. A streaming box sold far below the price of a mainstream equivalent has to make its money somewhere. Sometimes that somewhere is advertising, or data collection disclosed in fine print. In XCPE's case, Google says, it was the outright sale of access to criminals. The cheapest device in the house is also the one most likely to be connected to the television, the network and, through its accounts, to the rest of a family's digital life.
Bottom line
Google's disruption of XCPE is a genuine win: the command servers are down, a manufacturer accused of building the backdoor has been banned from the certified Android ecosystem, and criminal access to at least 10 million additional compromised devices should be cut off. But it is a partial win, and the honest version of this story says so. The 1.3 million boxes are still infected, the backdoor reinstalls itself, and no confirmed list tells every owner whether their box is one of them. If you own a cheap Android TV box, especially a MECOOL or other budget label, the safe move is to disconnect it, change the passwords you used on it, and replace it unless you can install genuinely trustworthy clean firmware. The takedown closed the criminals' remote control. Only the owner can close the door in their own living room.
Reference sources
- BleepingComputer: Google disrupts million-device XCPE Android malware botnet, bans TV box maker — https://www.bleepingcomputer.com/news/security/google-disrupts-million-device-xcpe-android-malware-botnet-bans-tv-box-maker/
- Help Net Security: Google disrupts XCPE botnet, bans the company behind it — https://www.helpnetsecurity.com/2026/11/02/xcpe-botnet-android-backdoor/
- The Register: Cops bust botnet of 1.3M infected Android TV boxes — https://www.theregister.com/cyber-crime/2026/11/02/cops-bust-botnet-of-13m-infected-android-tv-boxes/5307045
- The Verge, via UA.NEWS republication: Google says Chinese maker created botnet on 1.3 million devices — https://ua.news/en/technologies/google-zaiavila-pro-botnet-u-1-3-mln-pristroyiv-kitaiskogo-virobnika-the-verge
- SQ Magazine: Google Disrupts Massive Android TV Botnet, Bans Device Maker — https://sqmagazine.co.uk/google-videostrong-xcpe-backdoor-tv-box-botnet/
Leave a public comment