Google has shut down one of the largest botnets ever found in people’s living rooms. The XCPE botnet Android TV boxes scandal saw more than 1.3 million set-top boxes leave the factory with a hidden backdoor installed, while their maker sold access to criminals.
Google’s Threat Intelligence Group announced the takedown on November 2, 2026, with law enforcement in Japan and several security companies. The backdoor had run since at least 2024, and most owners had no idea their box was quietly working for someone else.
Nobody downloaded a bad app or clicked a dodgy link. The malware was built into the firmware before the boxes were shipped.
What Is the XCPE Botnet?
XCPE, also written as X.CPE, was a network of compromised Android devices controlled from remote servers. Google counted more than 1.3 million set-top boxes in it, while TrendAI counted 1,472,554 infected devices across 206 models between June and October 2026. Synthient estimated about 500,000 were actively online.
Most infected devices were Android TV set-top boxes, the cheap streaming boxes sold under dozens of brand names online. Google also found the backdoor on telehealth devices, karaoke machines, and digital signage screens.
Infections spanned more than 170 countries, concentrated in Malaysia, Brazil, Iraq, Mexico, and Taiwan, with notable numbers in the United States, China, and Germany.
How the Backdoor Got Into 1.3 Million TV Boxes
Google attributes the operation with high confidence to Videostrong Technology Co., a China-based Android manufacturer that built devices for many brands. In its report, “Shutting the Door on the XCPE Botnet,” Google says Videostrong deliberately embedded the backdoor in the firmware of devices it produced and operated it for profit.
The backdoor arrived as a system app called x.cpe, or com.oemservice in some versions. Because it lived in the protected firmware partition and ran with Android system privileges, it had far more power than an ordinary app: it could install software silently and switch off Google Play Protect’s app-verification setting first.
Videostrong also evaded Google’s checks, using obfuscation and loading malicious components only after a device’s first boot. That helped the backdoor pass testing for certified Android devices, and many affected boxes were certified, sold with Google apps preinstalled.
Independent researchers reached the same conclusion. Synthient traced the campaign to Videostrong after finding the backdoor preinstalled on a MECOOL KM9PRO Max box bought in late 2025. Its report lists 182 model strings, including MECOOL models such as the KM1, KM2, KM3, KM6, KM7, KM8, KM9PRO, and KT1. Videostrong updated the malware in 2024 and again in 2026.
What the Infected Boxes Were Used For
Videostrong did not just build the backdoor. Google says it sold access to criminal affiliates, who loaded their own malware onto the infected devices and turned them into tools for several kinds of crime.
First, they were used as residential proxy nodes: other people’s internet traffic was routed through the victim’s home connection, hiding the real origin of scams and attacks. The owner pays for the broadband; the criminal gets a clean residential IP address.
Second, the boxes generated fraudulent advertising activity, silently loading ads and fake clicks. Third, they installed further malware, since affiliates could push extra software onto the device without the owner doing anything.
Google also found more than a dozen separate malware families being delivered through the backdoor. Taking down XCPE was therefore not just about one botnet, but about cutting off a delivery service used by many criminal groups.
How Google Took the Botnet Down
Google worked with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient, and TrendAI, taking legal action against the domains and servers Videostrong used to control the botnet and the command-and-control domains of the malware loaded through it.
Google estimates the disruption will cut criminal access to at least 10 million more compromised devices, because the same infrastructure served other infected hardware too.
Google also cut ties with Videostrong, withdrew its licence to build Android TV devices with Google apps preinstalled, and banned the company and any future subsidiaries from building or selling certified Android devices or supplying software to certified vendors.
Google said it has tightened its firmware integrity checks for certified Android TV devices. The takedown follows an earlier action against BadBox 2.0, a botnet that hit more than 10 million uncertified Android devices. Cheap Android hardware has become a major battleground for supply-chain attacks.
Which Devices Were Affected?
There is no single complete list of affected devices. TrendAI counted infections across 206 models and Synthient listed 182 model strings, but many boxes were white-label products sold under names that change from month to month.
The risk is highest for cheap, unbranded Android TV boxes from online marketplaces. Well-known brands were not named in Google’s report. The MECOOL models listed by Synthient are the clearest warning sign; MECOOL owners should check their model against the published lists.
The danger is not limited to television boxes. The backdoor also turned up in telehealth equipment, karaoke machines, and digital signs, so any Android device from an obscure brand deserves a second look.
This echoes the Zyxel switch attack covered on this site recently: the quiet hardware in your home or office can be the weakest link. There, a zero-day flaw in network switches let attackers in through the wiring closet. Here, the threat was built in at the factory. Read our report on the Zyxel GS1900 zero-day for the full story.
How to Check If Your Android TV Box Is Safe
If you own an Android TV box, especially a cheap or unbranded one, check it now.
Start with the brand and model in Settings, then About. If it is a MECOOL model on the published lists, such as the KM9PRO or other KM-series boxes, treat it as suspect and seek guidance from the seller.
Check where you bought it. Boxes from major retailers under a recognised brand are far less likely to be affected than no-name boxes from marketplaces. A brand with no website, no support page, and no firmware updates is a red flag.
Watch for strange behaviour. A box that uses large amounts of data while idle, runs hot when nothing is playing, or shows ads outside of apps may be compromised. Check per-device usage in your router’s admin panel.
Keep the firmware updated, and treat a box that has never received one as suspect. Finally, use a separate network for smart devices where possible: many routers let you create a guest or IoT network, limiting what an infected device can reach.
What to Do If Your Box Is on the List
The takedown does not necessarily clean your device. Google cut off the control servers, so criminals can no longer send orders to the boxes. But the backdoor is still in the firmware of devices already sold, and researchers say it can reinstall itself from a protected partition after a reboot. A factory reset may not remove it.
Owners of confirmed affected models should not assume the problem is over. The safest option is to stop using the box and replace it with a device from a recognised brand with a real update programme, such as Google TV Streamer or Nvidia Shield. If you bought it recently, ask for a refund and mention the Google disclosure.
If replacing it is not possible right away, disconnect the box from the internet or unplug it entirely. Do not enter passwords, payment details, or personal accounts on a device you suspect is compromised, and change any passwords you reused elsewhere, starting with email and banking.
Proxy networks like this one are often used to send fraud at scale, so it is worth knowing how to spot a phishing email too.
Why This Matters Beyond TV Boxes
XCPE breaks a basic assumption: that a device bought new, in a sealed box, is clean. Here, the supply chain itself was the attacker. The backdoor was not smuggled in by a hacker; the manufacturer installed it deliberately, as a business model.
That is hard to fix. No antivirus app can be trusted if the firmware underneath it is compromised, and no password can protect a device whose operating system works against its owner. The only real defences are certification, testing, and enforcement, which Google says it is tightening.
There is a wider warning for every connected device in the home. Televisions, cameras, doorbells, thermostats, and even medical devices increasingly run the same Android software, often built by the same small group of manufacturers. XCPE stopped one operation, but selling compromised hardware at scale will attract imitators.
What Happens Next
The servers are down, but the story is not finished. Researchers will keep publishing lists of affected models, and more victims will come forward as people check their boxes. Google has promised tighter checks; other manufacturers will watch to see if they have real teeth.
For owners, the advice is simple: check your Android TV box, and if it is an obscure model with no updates and no support, replace it. A streaming box should show you television, not quietly rent out your internet connection to criminals.
XCPE was stopped because researchers, companies, and police worked together. The next one may be harder to find. Until the industry fixes how cheap connected hardware is made, stick with brands that can be held accountable.