Google Takes Down a 1.3 Million-Device Android TV Box Botnet, and Says the Box Maker Built It

The cheap streaming box under a lot of TVs was never really a bargain. Google just put a number on what some of them were doing behind the screen.

On November 2, Google’s Threat Intelligence Group said it had dismantled XCPE, a backdoor that enrolled more than 1.3 million Android TV set-top boxes into a botnet. Google says it is highly confident the backdoor wasn’t slipped in by outside hackers. It says the box maker built it. The company it names is Videostrong Technology Co., a Shenzhen-based manufacturer that builds Android devices under its own name and for other brands.

“A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust,” Google’s researchers wrote.

What Google did about the XCPE botnet

The takedown happened last week, working alongside Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google took legal action against the domains and servers used to control the botnet and push malware modules to the boxes, plus the command servers of more than a dozen other malware families that rode along through the backdoor.

Then it went after the company. Google says it has cut ties with Videostrong and banned it, along with any future subsidiaries or affiliates, from building or selling certified Android devices, from shipping devices with Google’s apps preloaded, and from supplying software to other certified manufacturers.

Google also admitted a gap in its own process. Videostrong reportedly obfuscated its code so the malicious parts loaded only after a device’s first boot, slipping past Google’s compatibility and security testing. Google says it has changed its review process and tightened firmware integrity checks for certified Android TV devices.

What the backdoor did inside your living room

XCPE ran as a system app with system-level privileges. According to Help Net Security and The Hacker News, it switched off Google Play Protect’s app scanning by rewriting the package-verification setting, then let operators silently install apps, run commands, take live screenshots, inject keystrokes, open a remote shell and map the home network the box sat on.

Videostrong, Google says, sold that access to criminal affiliates. Their modules turned boxes into residential proxies, routing strangers’ internet traffic through the victim’s home connection, faked ad views for ad fraud, and copied account and device details.

It was also hard to kill. The main component reinstalls itself from a protected partition after a reboot, so uninstalling the app does nothing. Since August 2026, operators had been using droppers disguised as system packages that used a privilege-escalation exploit to write to the system partition.

The numbers

Most infections were in Malaysia, Brazil, Iraq, Mexico and Taiwan. The U.S., Germany, the U.K., Australia and Canada each had roughly 26,000 to 42,000. That’s a small slice of a big number, but it’s tens of thousands of American households whose internet connection may have been rented out to strangers.

Is your Android TV box affected?

Here’s the uncomfortable part: there isn’t a simple “check this setting” answer. Plume found the botnet included both Google-certified boxes and boxes running plain Android Open Source Project builds, and as of November 2, Videostrong’s own website still listed products it calls “Google Certified Android TV Box” and “Google Certified Android TV Stick.” Google hasn’t said how many certified devices were hit.

What researchers did publish:

• MECOOL is the brand to watch. Synthient’s report focuses on MECOOL-branded boxes, which it ties to Videostrong, and Plume found most of the infected devices it saw were MECOOL units.
• There’s a model list. Synthient posted 182 model names seen in the campaign on GitHub. It warns that a matching model name alone doesn’t prove a box is infected.
• Resets may not help. Plume recommends a full factory reset, but the malware’s self-reinstalling design means that isn’t a guaranteed cure. TrendAI says cleanup requires “vendor action, platform protection or replacement of the device.”
• Synthient’s advice to consumers is blunt: unplug the box and throw it out.

If you own a no-name or MECOOL box, our advice matches Synthient’s. Disconnect it from your network. If you’re a remote worker, TrendAI’s warning applies to you too: an unmanaged box on your home Wi-Fi is part of your employer’s attack surface.

What to buy instead

Google’s guidance is to “only purchase connected devices, such as set-top boxes, from reputable manufacturers,” and it points to its Android TV partner list at android.com/certified/partners. Given that certification didn’t stop Videostrong, we’d go a step further and stick with streaming hardware from big names that answer for their own software, like Google’s own TV Streamer, a TV with Google TV built in from a major brand, or a mainstream Roku or Fire TV device.

Google also says to be “extremely wary” of apps offering money for your “unused bandwidth,” to stick to app stores you trust, and to keep Google Play Protect switched on.

Our take

This is the second time in about 16 months Google has gone after Android TV box malware at scale. In July 2025 it sued over the BadBox 2.0 botnet, which involved more than 10 million uncertified devices. XCPE is worse in one important way: it reached boxes sold as certified, and Google says the manufacturer itself was the attacker.

Banning Videostrong is the right move, and Google deserves credit for owning the testing gap. But the lesson for buyers hasn’t changed. When a no-name streaming box costs less than a couple of months of streaming subscriptions, somebody is making up the difference, and it might be you.

Sources: Google Threat Intelligence Group, The Hacker News, Help Net Security. Photo by Jonas Leupe on Unsplash.