XCPE Botnet: Google Says a TV Box Maker Built a Backdoor Into 1.3 Million Devices
Google says a certified Android device maker deliberately infected its own products and sold access to criminals. On Monday, November 2, Google announced that it worked with industry partners to dismantle a botnet of more than 1.3 million Android TV set-top boxes, according to Krebs on Security. The botnet is called XCPE, and Google has cut ties with the Chinese manufacturer it blames, Videostrong Technology.
What the XCPE Botnet Did
A report from the Google Threat Intelligence Group says Videostrong built the backdoor into its firmware and monetized it by selling access to criminal affiliates. Those affiliates loaded their own malware onto infected devices.
The infected boxes were used to make their owners’ internet connections available for rent through residential proxy services. CyberScoop adds that criminals also used the botnet for ad fraud, data theft and routing malicious traffic through home networks.
Most of the devices were TV set-top boxes, but the same malware turned up in Android-based telehealth devices, karaoke machines and digital signs.
How It Passed Google’s Checks
Google requires makers of certified Android devices to pass compatibility and security tests. Krebs reports that Videostrong still found a way to load malicious software right after a user first booted a device, and that Google says it has since closed that weakness.
Cybernews reports that Google also changed its review process to better check the integrity of firmware on certified Android TV devices. Reports say the backdoor switched off Google Play Protect app verification before installing apps.
Tech Times describes the case as the first documented instance of a Play Protect-certified manufacturer deliberately embedding a botnet in certified hardware. That is Tech Times’ characterization, not Google’s.
The Takedown and the Ban
Google says it took legal action against the domains and servers that controlled the botnet. It also took down command domains used by more than a dozen malware families that the backdoor loaded.
That action should cut criminal access to at least 10 million additional compromised devices, according to the Google report, because Videostrong’s affiliates have other ways of distributing their software. Synthient founder Ben Brundage told Krebs the 1.3 million figure is highly conservative, and called this probably the largest operation against backdoored TV boxes his team has seen.
Google has banned Videostrong and any future subsidiaries or affiliates from making certified Android devices or supplying software to certified vendors. Partners in the takedown include Synthient and Japan’s National Police Agency, according to DigitBin.
Which Devices Are Affected
Synthient examined a pre-infected box sold under the MECOOL brand by Skyworth Technology, a publicly traded Chinese company. It concluded that MECOOL also bundled Videostrong’s malware and proxy software. Krebs says Synthient published a list of affected devices by model number.
SQ Magazine reports that security firm TrendAI counted 1,472,554 infected devices across 206 models, and says owners cannot remove the implant themselves.
What Owners Should Do
Synthient advises owners to permanently dispose of affected devices and change their Wi-Fi passwords. The rest of this section is our own advice.
If you own a MECOOL box or any low-cost unbranded streaming box, check your model against Synthient’s list. Disconnect any box you suspect from your network until you are sure. Because proxy malware uses your home connection, also change your router password and keep your other devices updated.
When buying a new box, Google advises choosing reputable manufacturers listed as partners on the Android TV website and keeping Play Protect switched on. Krebs notes that many of these boxes win customers through influencer promotions of cheap pay-TV streaming, so be wary of devices that promise a lot for a one-time fee.
Related Reading
Smart devices are now common targets. See our guide to protecting your digital privacy in 2026, our list of the best smart home gadgets of 2026 and our roundup of the worst cyberattacks and data breaches of 2026.
