Google and a group of industry partners have dismantled XCPE, a backdoor that enrolled more than 1.3 million Android TV set-top boxes into a botnet. In a report published November 2, 2026, Google Threat Intelligence Group said it assesses with high confidence that the malware was intentionally built, deployed and run for profit by the device maker itself, Videostrong Technology Co.
Google said Videostrong, an Android original equipment manufacturer (OEM) and original design manufacturer (ODM), sold access to the infected boxes to criminal affiliates and loaded their malware modules onto the devices. Those modules carried out ad fraud, quietly turned boxes into residential proxy exit nodes and installed more malware. Google has cut ties with the company and banned it from building devices with preloaded Google apps.
What Google and its partners took down
The takedown happened last week, according to Google. The company said it used legal action to take down the domains and servers Videostrong used to control the botnet and push modules, along with command and control (C2) domains used by more than a dozen malware families delivered through the backdoor. Google did not name a court or case number in its report.
Because those affiliate malware families also spread through channels beyond XCPE, Google assesses that seizing their C2 domains will cut off access to at least 10 million additional compromised devices.
Google worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. “Operations like this raise the cost for criminals and show that the infrastructure they rely on isn’t out of reach,” Charley Snyder, head of disruption operations at Google Threat Intelligence Group, said in a joint announcement from Plume.
Google also said it has:
- Banned Videostrong and any future subsidiaries or affiliates from building and selling certified Android devices or supplying software to other certified vendors
- Changed its device review process after finding that the malware used obfuscation to exploit a gap in its tests and load malicious code after a device’s first boot
- Started improving how it checks the integrity of firmware on certified Android TV devices
A backdoor that ships inside the firmware
The core backdoor runs as x.cpe, or com.oemservice in some builds, and is preloaded in the firmware with system-level privileges. If a user uninstalls it, it reinstalls itself from the /oem/ partition on the next reboot. Google said the malware disables Google Play Protect app verification so it can silently install new apps.
Since at least late 2024, the malware has used a separate loader, com.abc.nexus, to run monetization modules. Google said the split may have been a response to its earlier enforcement against the BadBox operation. Since August 2026, operators have been pushing new droppers disguised as Android system apps. The botnet receives commands over MQTT, a lightweight messaging protocol.
Beyond installing modules, Google said it observed Videostrong operators capturing live screenshots, injecting keystrokes, stealing account and device information and opening reverse shells on some devices. Most infected devices were set-top boxes, but Google also found the backdoor on telehealth devices, karaoke machines and digital signage.
How big the botnet got
TrendAI, which supplied intelligence for the operation, said in its own report that it counted 1,472,554 infected devices across 206 models in more than 170 countries between June and October 2026. The partners settled on a joint figure of more than 1.3 million because their snapshots differed.
- Residential IP addresses: 3,849,226 distinct exit addresses over 4 months, with an average of about 182,000 available on a single day
- Top countries: Malaysia, Brazil, Iraq, Mexico and Taiwan
- Western exposure: The US, Germany, the UK, Australia and Canada each had about 26,000 to 42,000 infected devices
Because the traffic came from real home connections, it could slip past IP reputation and geolocation checks that banks, retailers and online services rely on, TrendAI said.
Synthient said in its technical report that it found the backdoor preinstalled on a MECOOL KM9PRO Max box and linked the MECOOL brand to Videostrong. The report was produced with the Motion Picture Association.
What owners of these boxes should do
The takedown cut off the botnet’s control servers, but it did not remove the malware from devices. TrendAI said owners cannot remove the implant themselves because it runs as a system app signed with the manufacturer’s key. Synthient advised consumers to permanently dispose of affected devices and urged online retailers to pull them from sale.
Google recommends buying set-top boxes only from reputable manufacturers and checking its Android TV partner list. It also warned users to avoid apps that pay for “unused bandwidth,” since those are a main way illicit proxy networks grow.
Part of a familiar pattern
XCPE sits in the same ecosystem as BadBox 2.0, which infected more than 10 million uncertified Android devices. Google sued the alleged BadBox 2.0 operators in July 2025. Google said 2 malware families loaded through XCPE, Moyu and Bird, were previously tied to the BadBox enterprise.
Cheap streaming boxes have become a steady source of botnet capacity. Earlier this year, BreachNews covered the DOJ disruption of 4 major IoT botnets, including Aisuru and KimWolf. What sets XCPE apart is Google’s claim that the manufacturer itself built and sold access to the backdoor.
Videostrong had not issued any public statement at time of publication.
