Google says Videostrong, a maker that built Android TV boxes under its own brands and for other labels, placed a backdoor called XCPE inside the firmware of more than 1.3 million devices and sold access to criminal affiliates. Google and its partners have now cut the control servers and banned the maker from certified Android, while owners are left with boxes that still carry the implant.
The box under the television was working for someone else. Google said on November 2 that more than 1.3 million set top boxes left the factory with a backdoor inside the firmware, and that the maker itself built it, ran it, and sold access to it. The control servers are now down. The backdoor is still sitting in the boxes.
This was not a hacker breaking in from outside. Google Threat Intelligence Group says the implant shipped with the product, survived the checks that certified devices must pass, and turned living room hardware into rental space for criminals. Owners got no consent request, no notice, and no switch to turn it off.
The Announcement
Google assesses with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co. Videostrong is an Android OEM and ODM, meaning it builds devices under its own names and designs hardware that other brands sell as theirs. Google says it found the malicious software built directly into many different device models and brands over multiple years.
The takedown was a joint operation. Google worked with Japan’s National Police Agency and with Lumen, HUMAN Security, Plume, Synthient, and TrendAI to map the network and disrupt it in late October. Google then took legal action against the domains and servers used to control the botnet and to install malware modules on the boxes.
A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust.
Google also moved against the customers of the backdoor, not only its builder. It took legal action against the control domains of more than a dozen malware families that were loaded onto devices through XCPE. Because those affiliates also spread their modules through other channels, Google assesses that cutting their control domains will sever access to at least 10 million additional compromised devices.
How the Backdoor Worked
The primary backdoor, tracked as x.cpe and running as com.oemservice in some builds, sits in the firmware and runs at the android.uid.system privilege level. That is the level of the operating system itself, far above anything an ordinary app can reach. If a user uninstalls it, the package reinstalls itself from the /oem/ partition when the box reboots.
Since late 2024 the design has run in three stages, per Google. The backdoor handles contact with the control servers. A loader, com.abc.nexus, ran the money making modules, though Google says that loader has lately been phased out in favour of smaller droppers disguised as Android system apps. The third stage is the modules themselves, built by affiliates and loaded onto the boxes for a fee.
The shape of the operation: one backdoor in the firmware, one loader, and a rotating cast of paid modules. Image: Google
Through that channel, operators could silently install apps, run shell commands with system privileges, capture the screen, inject keystrokes, and collect account information, device details, app lists, and system logs. The backdoor could also disable Google Play Protect app verification, clearing the way for new code to land without a warning. The modules then did the earning: they enrolled boxes into residential proxy networks such as Linkfog, AppSalt, and NetNut, ran ad fraud through modules such as CBOXTV and HiddenView, or installed further backdoors such as Moyu, Spirit, and Bird. Google says a single device could run as many as three residential proxy SDKs at once.
Important Details
| Item | Detail |
|---|---|
| Backdoor | XCPE, running as x.cpe or com.oemservice |
| Maker named by Google | Videostrong Technology Co., an Android OEM and ODM |
| Devices enrolled | More than 1.3 million set top boxes, across more than 200 countries |
| Other hardware found | Telehealth devices, karaoke machines, and digital signage |
| Privilege level | android.uid.system, inside the firmware |
| Persistence | Reinstalls from the /oem/ partition after removal and reboot |
| Affiliate uses | Residential proxies, ad fraud, and further backdoors |
| Takedown reach | Control domains for XCPE and for more than a dozen affiliate malware families |
| Wider effect, per Google | Access cut to at least 10 million more compromised devices |
| Penalty for the maker | Banned, with any future subsidiaries or affiliates, from building or selling certified Android devices or supplying software to certified vendors |
Where the boxes turned up: a global spread, with the heaviest shading marking the largest concentrations. Image: Google
Synthient, one of the partner firms, says it traced the operation after finding the malware already installed on a MECOOL KM9PRO Max box bought in late 2025, and it has published a list of device model names seen in the campaign. MECOOL is a brand linked to Videostrong. That detail matters for owners: the name on the front of a box may not be the name of the company that built its firmware.
What’s Next
Confirmed: Videostrong is out of certified Android. Google has cut ties with the company, banned it and any future subsidiaries or affiliates from the certified device programme, and changed its own review process to close the first boot gap the implant used. The affiliate control domains are down, which Google expects to blunt a much larger pool of compromised hardware beyond the XCPE boxes themselves.
Open questions are the ones owners care about most. Google has not announced a way for an owner to check a specific box model against a full list and clean it, and no response from Videostrong appears in the reporting on the takedown. Whether the dormant implants stay dormant depends on the operators never standing up new control infrastructure, and that is an enforcement hope, not a technical guarantee.
The lesson is blunt. A cheap streaming box is a computer that lives on your home network with your bandwidth, your IP address, and, in this case, a landlord you never met. Price was the feature. Access to your connection was the product.
Sources
- Google Threat Intelligence Group, Shutting the Door on the XCPE Botnet, November 2, 2026. Primary source for the attribution to Videostrong, the three stage design, the persistence method, the affiliate modules, and the takedown actions. Both body images are from this report and are credited to Google.
- Plume, Google Leads Industry Takedown of Botnet Hidden in More Than 1.3 Million Set Top Boxes across 200 Countries, November 2, 2026. Partner release for the scale across more than 200 countries and the absence of any consent or opt out for subscribers.
- BleepingComputer, Google disrupts million device XCPE Android malware botnet, bans TV box maker, November 2, 2026. Reporting on the Synthient investigation, the MECOOL KM9PRO Max discovery, and the signing evidence tying the backdoor to Videostrong.
END OF TRANSMISSION
Stay curious. Question everything.
