Google and industry partners say they have dismantled XCPE, a botnet of more than 1.3 million Android TV streaming boxes, and Google’s Threat Intelligence Group (GTIG) says the device maker put the malware there on purpose. In a report published Monday, GTIG said it assesses “with high confidence” that Videostrong Technology Co., an Android device manufacturer, built, deployed and operated the backdoor for financial gain and sold access to criminal affiliates. Those affiliates used the boxes for ad fraud, turned them into residential proxies that route strangers’ internet traffic through the owner’s connection, and installed further malware. Google has ended its relationship with Videostrong, revoked its license to make Android TV devices with Google apps, and banned the company from producing certified Android devices.
Unlike most botnets, XCPE was built into the firmware at the factory. The main backdoor, x.cpe (also com.oemservice), runs with system-level privileges, disables Google Play Protect, and can install apps silently, run shell commands, take screenshots and inject keystrokes. BleepingComputer reports that the research firm Synthient traced the backdoor to Videostrong after finding it preinstalled on a MECOOL KM9PRO Max box bought in late 2025, and that Google took down command servers for more than a dozen related malware families, cutting off at least 10 million additional compromised devices that were infected by other means. GTIG says Videostrong exploited a gap in Google’s certification tests by loading malicious code after a device’s first boot, and that Google has changed its review process.
How to check if you’re affected
Affected devices are Android TV and set-top boxes whose firmware contains the x.cpe or com.oemservice package; GTIG says it found the malware across many device models and brands over several years, and neither GTIG’s report nor BleepingComputer’s article publishes a full list of models. The one named example is the MECOOL KM9PRO Max, per BleepingComputer’s account of Synthient’s research. GTIG’s report includes indicator hashes for the x.cpe samples that researchers can check.
Removal is hard. BleepingComputer reports the takedown has not removed the malware from infected devices, and that it reinstalls itself from the /oem/ partition if deleted, so owners would need to install clean firmware or disconnect the box from the internet. GTIG’s consumer advice is to buy connected devices such as set-top boxes only from reputable manufacturers (it points to Google’s Android TV partner list), keep Google Play Protect on, stick to trusted app stores, and avoid apps that pay you for “unused bandwidth” or “sharing your internet.”
This is the latest of several Android TV box botnets we have covered, including the POPA botnet and the NetNut proxy network.
Sources
- Google Cloud Blog (GTIG): Shutting the Door on the XCPE Botnet
- Synthient: The Internals of a BADBOX Operation (linked from BleepingComputer; the page returned a bot challenge, so it was not read directly)
- BleepingComputer: Google disrupts million-device XCPE Android malware botnet, bans TV box maker