Android TV Botnet XCPE: Google Dismantles 1.3 Million-Device TV Network

Google and industry partners have dismantled a botnet of more than 1.3 million Android TV set-top boxes, after concluding that the manufacturer behind the devices deliberately built a hidden backdoor into their firmware and sold access to criminals. The operation, centred on a backdoor known as XCPE, is one of the largest takedowns of its kind, and it shows how cheap connected devices in ordinary living rooms can quietly become part of a global criminal network.

The Android TV botnet was not caused by users clicking a bad link or downloading a rogue app. According to Google's Threat Intelligence Group, the backdoor arrived preinstalled, ran with system-level privileges, and could reinstall itself every time a box rebooted. Owners could not simply delete it, and many may never have known their television box was working for someone else.

Key Points

• Google says the XCPE botnet enrolled more than 1.3 million devices, mostly Android TV set-top boxes.
• The backdoor, called x.cpe or com.oemservice, was preinstalled in firmware and ran with system privileges.
• Google blames Shenzhen-based Videostrong Technology, saying it built and operated the backdoor for financial gain.
• Infected boxes were rented out as residential proxies and used for advertising fraud and further malware.
• Google has banned Videostrong from certified Android devices, but the backdoor remains on boxes already sold.

What Happened

Google said it worked with industry partners to take down the domains and servers that controlled the XCPE botnet, cutting off remote access to the infected boxes. The takedown was carried out in the previous week, with legal action against the infrastructure Videostrong used to control the botnet and install additional malware. Partners named in the reports include Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

The Google Threat Intelligence Group report, published on Monday, assessed with high confidence that the backdoor and botnet were intentionally developed and operated for financial gain by Videostrong Technology Co., which sold access to criminal affiliates and loaded their malware modules onto infected devices.

The disruption also targeted control domains behind affiliate malware modules. Google estimated that step could sever access to at least 10 million additional compromised devices reached through channels beyond XCPE itself. That is an estimate of lost access, not a claim that those devices have been cleaned, and the company did not identify a consumer-facing cleanup tool for affected set-top boxes.

Background and Context

XCPE takes its name from one of the malware's core code components. The backdoor, a system app known as x.cpe and seen on some devices as com.oemservice, lived inside the firmware with system-level access and reinstalled itself from a protected partition on every reboot, surviving ordinary resets.

TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1, 2026. Synthient estimated about 500,000 compromised devices were actively online, concentrated in Malaysia, Mexico and Brazil, and the same malware was also found in telehealth devices, karaoke machines, projectors and digital signage.

Android TV Botnet: How the Boxes Were Exploited

Once enrolled, an infected box loaded software that made its internet address available for resale by residential proxy services, which let customers rent ordinary-looking addresses to anonymise traffic or spoof location. Modules linked to XCPE included AppSalt, also known as Honeygain, Linkfog, NetNut and Traffmonetizer.

The same access was used for advertising fraud, in which infected devices generate fake ad views or clicks, and for delivering further malware. Google said it watched Videostrong's operators use the backdoor's powers in more intrusive ways, including live screenshots, injected keystrokes, exfiltrated account details, device information, app lists and system logs, and reverse shells into the box, giving an operator remote command access inside a home network.

Attribution rests on several threads. Google found that x.cpe passed settings to other Videostrong apps, including YokaTV Player, and that a GitHub account hosting the botnet's packages was named yf-videostrong. Synthient bought a MECOOL KM9PRO Max and confirmed the backdoor was preinstalled, while Plume saw more than a dozen devices, mostly MECOOL-branded, talking to the control server.

Reactions and Quotes

Google's assessment was blunt: Videostrong monetised the backdoor by selling access to criminal affiliates and loading those affiliates' malware modules onto infected devices. The company said it requires all Android device makers to pass compatibility and security tests, but that Videostrong nevertheless found a way to load its malicious software at first boot.

Security researchers stressed that cutting off the servers is only half the job. The backdoor remains in boxes already in homes, and no XCPE-related recall, clean-firmware update or mass-replacement scheme was indicated in public documents reviewed on November 3.

Why It Matters

The takedown matters for three reasons. First, scale: 1.3 million devices is a large botnet, and the estimated 10 million additional devices reachable through affiliate infrastructure show how one backdoor can feed many criminal operations. Second, stealth: victims did not need to do anything wrong, so a box streaming normally while secretly renting out its owner's connection leaves almost no trace. Third, trust: the bargain of a cheap box collapses when the manufacturer itself is alleged to be the operator.

What Happens Next

In the short term, the takedown should reduce the botnet's activity, since infected boxes can no longer reach their old control servers. Affiliates will look for replacement infrastructure, and researchers will watch whether XCPE devices reconnect to new domains. Google and its partners are expected to keep monitoring the infrastructure and to publish further technical indicators for defenders.

For owners, the next step is identification. Anyone with a low-cost Android TV box, particularly a MECOOL-branded or Videostrong-built model, should check the brand and model, look for any vendor notice, and consider replacing a box that cannot be verified as clean.

Frequently Asked Questions

What is the XCPE botnet? XCPE is a backdoor and botnet built into the firmware of more than 1.3 million Android devices, mostly TV set-top boxes, used for ad fraud, residential proxy traffic and further malware delivery.

Who does Google blame? Google assesses with high confidence that Shenzhen-based Videostrong Technology intentionally developed, deployed and operated the backdoor for financial gain, selling access to criminal affiliates.

Can owners remove the backdoor themselves? No, according to the reports. It runs with system privileges from a protected partition and reinstalls on reboot, so removal needs vendor action, platform protection or device replacement.

Does the takedown clean infected boxes? No. It cut off the control servers and affiliate infrastructure, but the malware remains in the firmware of boxes already sold.

How can I tell if my box is affected? Check whether your box is a Videostrong-built or MECOOL-branded model, watch for vendor notices, and replace any cheap Android box you cannot verify as clean.

Related coverage: Anthropic's IPO filing and the AI spending boom, Meta's $95 billion AI raise, and Big Tech's earnings test on AI spending.