XCPE Botnet Takedown: What It Means for Android TV Box Owners

By Jaspal Singh November 3, 2026 Updated: November 3, 2026

Google and its partners have cut off the XCPE botnet, more than 1.3 million Android TV boxes whose maker, Videostrong, allegedly built a backdoor into the firmware and sold access to criminals. The servers are gone, but the backdoor stays on each box and owners cannot remove it, so replacing an affected box is the safest fix.

What Happened

In a report published at the start of November 2026, the Google Threat Intelligence Group said that Google and industry partners had, the previous week, "dismantled the XCPE backdoor which enrolled more than 1.3 million set-top boxes into a botnet." Google took legal action against the domains and servers used to control the boxes and to install extra malware on them, and against the control domains of more than a dozen other malware families that were loaded through the same backdoor. Google estimates that removing those domains will cut criminals off from "at least 10 million additional compromised devices." The full technical write-up is in Google's XCPE threat intelligence report.

The unusual part is who Google blames. It says it assesses "with high confidence" that the backdoor and botnet were deliberately built and run for profit by Videostrong Technology Co., a Shenzhen-based company that designs and manufactures Android devices under its own name and for other brands. Google says it does not believe the backdoor was the work of a rogue insider or a development oversight. It has cut ties with Videostrong and banned the company, plus any future subsidiaries or affiliates, from building certified Android devices or supplying software to other certified makers.

Several outside groups contributed. Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI are all named as partners. TrendAI's telemetry counted 1,472,554 infected devices across 206 models in more than 170 countries between June 3 and October 1, 2026, according to TrendAI's research note on the botnet. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most infected devices, while the US, Germany, the UK, Australia and Canada each had roughly 26,000 to 42,000. Every group involved describes its figures as a floor, not a ceiling.

Krebs on Security reported Synthient's finding that MECOOL-branded boxes, sold by Skyworth Technology, shipped with Videostrong's backdoor alongside proxy software. Synthient bought a MECOOL KM9PRO Max and found the backdoor preinstalled, and Plume found that most of the devices it saw talking to the control server were MECOOL models.

Why It Matters

Most Android malware stories are about a bad app someone chose to install. XCPE is different: the backdoor arrived with the device, sat in the part of the system that owners cannot change, and was allegedly put there by the company that made the firmware. That turns the usual advice on its head. Installing apps only from the Play Store and keeping Play Protect turned on would not have helped, because the backdoor switched Play Protect's checks off by itself.

It also matters for who ends up paying. An infected box keeps streaming video normally, so the owner sees nothing wrong. Meanwhile their home internet address is rented out to strangers through residential proxy services, which means scraping, credential stuffing or fraud can be traced back to that household. Ad fraud modules loaded fake ad views in the background, which costs advertisers money and uses the owner's bandwidth and electricity.

Finally, it matters because some of the boxes were certified. Plume says the botnet included both Google-certified devices and devices running the open-source version of Android without Google's apps. Google says Videostrong used obfuscation to slip past a gap in its compatibility and security tests and loaded the malicious code only after the device's first boot, when certification testing was already over. Videostrong's own website was still listing "Google Certified" Android TV boxes and sticks on November 2.

How It Works

According to Google's report, x.cpe is a small app placed in the firmware's system partition and run with system-level privileges, the same level used by core parts of Android. Because it lives there, an owner cannot uninstall it in a lasting way: if it is removed, a component that starts on boot simply puts it back after the next restart.

Once running, x.cpe contacts its control servers and waits for instructions. Before installing anything, it wipes the user's consent setting for app verification and turns Google Play Protect's checks off, so new packages can be installed silently without being scanned. Google says that since at least late 2024 the malware has used a three-stage design, and since August 2026 new dropper packages have appeared that Google believes were meant to help it avoid detection.

The backdoor itself was the delivery truck. What paid was the cargo: modules from other criminal groups, which Videostrong allegedly sold access to. Google groups them into three kinds:

Residential proxy and bandwidth-sharing modules, such as Linkfog, AppSalt and NetNut, which resell the box's internet connection so customer traffic appears to come from an ordinary home.
Ad fraud engines, such as CBOXTV and HiddenView, which load and "watch" ads invisibly.
Further backdoors, such as Moyu and Spirit, which give other operators their own way into the device.

Researchers also saw the operators use the backdoor for far more intrusive work: running commands, taking live screenshots, injecting keystrokes, opening a reverse shell, collecting account and device details, and mapping the home network the box was connected to. That last capability is why a cheap streaming box on a home network is a security problem for every other device on it, including work laptops.

The takedown attacked the control layer rather than the boxes themselves. Seizing the domains and servers means infected devices can no longer reach the people who were sending them orders, and cutting the affiliate domains disrupts the criminal groups who rented access. But the code is still sitting in each box's firmware. TrendAI's position is that cleanup "needs vendor action, platform protection or replacement of the device," and the vendor in this case is the company accused of planting it.

What's Still Unknown

The true number of infected devices is not known. Google says more than 1.3 million, TrendAI counted nearly 1.5 million in four months, and Synthient's founder calls the headline figure "highly conservative." Google also has not said how many of the infected boxes were certified devices rather than uncertified ones.

There is no complete list of affected models. Synthient has published a list of 182 device model names seen in the campaign, but it warns that a matching model name does not prove a particular box is infected, because the same name can be used on different hardware and firmware.

Google has not named the court or published the legal filings behind the takedown, and it has not said whether Videostrong faces any action beyond losing its Android certification. Nor has it said what exactly it changed in its device review process or how it will check firmware integrity in future. Videostrong has not, as of this writing, publicly responded. And it is unclear whether Google can push any fix through Play Protect or system updates to boxes whose firmware is controlled by the accused vendor.

Frequently Asked Questions

What is the XCPE botnet?

XCPE is a botnet of more than 1.3 million Android devices, mostly cheap TV set-top boxes, built around a backdoor app called x.cpe that sat in the devices' firmware. Google says the box maker Videostrong put it there on purpose and sold access to criminal groups, who used the boxes as residential proxies and for advertising fraud.

Is my Android TV box infected?

There is no single on-screen test. Start with the brand: Google's partner list shows which makers ship certified Android TV devices, and Synthient has published 182 model names seen in the campaign. A match is a warning sign rather than proof, and a box that is not on the list is not automatically clean. Boxes sold as MECOOL models were the most common in Plume's analysis.

Does a factory reset remove x.cpe?

Probably not on its own. Google says x.cpe lives in the read-only system partition and reinstalls itself on reboot if it is removed, so a reset returns the box to firmware that still contains it. Plume still recommends a full reset to clear extra modules the backdoor may have installed, but TrendAI says real cleanup needs vendor action, platform protection or a new device.

Is the box safe now that the servers are gone?

Safer, not safe. The takedown cut the link between infected boxes and the servers that sent them commands, so they should stop taking new orders for now. The backdoor itself is still in the firmware, and because the box maker controlled the firmware, nothing technical stops a new control server being pointed at the same devices later.

Why would a device maker sell access to its own boxes?

Money. A home internet connection is worth paying for because traffic from it looks like an ordinary household rather than a data centre, which helps scrapers, ad fraudsters and attackers avoid blocks. Each box can be rented as a proxy or used to fake ad views, and with over a million boxes the small per-device income adds up quickly.

What did Google change after the takedown?

Google cut ties with Videostrong and barred it, along with any future subsidiaries or affiliates, from building certified Android devices or supplying software to certified makers. It also says it has changed its review process and is improving how it checks firmware integrity on certified Android TV devices, though it has not published the details of either change.

Should businesses worry about these boxes?

Yes, if staff work from home or devices like digital signage run Android. The backdoor could map the local network, run commands and take screenshots, so an infected box on the same network as a work laptop is a foothold. Synthient advises disconnecting and discarding affected devices, blocking the published control domains and keeping smart devices on a separate network segment.