> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Google Takes Down 1.3M-Device Android TV Box Botnet
- URL: https://blog.harshkohli.com/google-xcpe-android-tv-box-botnet/
- Published: 2026-11-02T19:05:52.000Z
- Updated: 2026-11-02T19:05:52.000Z
- Description: Google says Videostrong shipped the XCPE backdoor on 1.3M Android TV boxes and sold access to criminals. Here is how to check your box.
- Author: Harsh Kohli
- Tags: Tech News, Software

If you've got a cheap Android TV box plugged into your telly, this one is worth five minutes of your evening. Google says one of the companies that builds these boxes put a backdoor into them on purpose, then rented that access out to criminals.

## What happened

In a [Google Threat Intelligence report](https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/?ref=blog.harshkohli.com), Google says it worked with partners last week to dismantle a botnet of more than 1.3 million set-top boxes running a backdoor called XCPE (it shows up as x.cpe, and as com.oemservice in some builds). Google says it has "high confidence" the backdoor was built and run for profit by Videostrong, a Shenzhen device maker that also supplies boxes for other brands.

The backdoor sits in the firmware with system-level rights. Delete it and it reinstalls itself from a protected partition on the next reboot. Its job was to load paid add-ons from Videostrong's "affiliates": ad-fraud tools, residential proxy software that routes strangers' traffic through your home connection, and yet more backdoors. Google says Videostrong got past Android's certification tests by loading the bad code only after the first boot.

Google took legal action to take down the domains and servers behind it, plus the control servers of more than a dozen malware families riding on it. It reckons that cuts criminals off from at least 10 million more infected devices. Videostrong, along with any future subsidiaries, is now banned from building certified Android devices or supplying software to other certified makers. Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI helped. [The Hacker News flagged it on X](https://x.com/TheHackersNews/status/2117283385261556137?ref=blog.harshkohli.com) and has a [detailed write-up](https://thehackernews.com/2026/11/google-disrupts-13-million-device.html?ref=blog.harshkohli.com) with the partner findings.

## Why it matters

This wasn't a hacker sneaking malware onto a product. Google is saying the maker shipped it. That's why the usual advice of "just update" doesn't help much here. The control servers are down, but the backdoor is still sitting on the boxes, and the people behind this kind of operation tend to switch infrastructure quickly.

It's also not only a far-away problem. TrendAI counted about 1.47 million infected devices across 206 models between June and October, with Malaysia, Brazil, Iraq, Mexico and Taiwan worst hit, and roughly 26,000 to 42,000 each in the US, Germany, the UK, Australia and Canada. Most are TV boxes, but it also turned up on telehealth gear, karaoke machines and digital signage.

## What to do

- Check what you own. Synthient has published a list of 182 model names seen in the campaign, and MECOOL-branded boxes come up a lot. A model on the list isn't proof of infection, but it's a strong hint.
- If the box has the Play Store, check its "Play Protect certification" status, which on most devices sits under Play Store settings, then About. An uncertified box from a brand you've never heard of deserves suspicion.
- If your box is on the list, the safest move is to unplug it and replace it with a certified streamer from a known brand. Plume suggests a full factory reset at minimum, but a reset may not remove a firmware-level backdoor.
- If you can't replace it yet, put it on a guest Wi-Fi network away from your laptop and phone, and keep work devices off that network.

Network-wide DNS filtering won't fix a backdoor, but it helps you spot weird traffic. My [Pi-hole vs AdGuard Home comparison](https://blog.harshkohli.com/pihole-vs-adguard-home/) is a good place to start.