XCPE Android TV box botnet: Google bans Videostrong, 1.3 million devices, backdoor stays in firmware

Google's Threat Intelligence Group (GTIG) said on November 2, 2026 that it and partners dismantled the control servers of XCPE, a backdoor built into the firmware of Android TV set-top boxes that enrolled more than 1.3 million devices into a botnet. GTIG says it assesses "with high confidence" that Shenzhen-based manufacturer Videostrong Technology built and operated the backdoor for profit, and has cut ties with the company. For owners the awkward part is that the takedown removed the operators' servers, not the backdoor itself: it is still in the firmware of boxes people already own.

Key points

• GTIG attributes the XCPE backdoor and botnet, with high confidence, to Videostrong Technology Co., an Android device maker, and says it was built "for financial gain" (Google Cloud blog, November 2, 2026).
• More than 1.3 million devices, mostly Android TV set-top boxes, were enrolled. TrendAI counted 1,472,554 infected devices across 206 models in its telemetry from June 3 to October 1.
• Google banned Videostrong and any future subsidiaries or affiliates from building and selling certified Android devices, and took legal action against the domains and servers used to control the botnet.
• Google expects taking down affiliate command domains to cut off at least 10 million more compromised devices that were infected by other routes.
• The backdoor, x.cpe, reinstalls itself from the firmware's /oem/ partition after a reboot, so uninstalling it does not work.

What to do

Google has not published a list of affected models, and no source we read offers a removal tool. What the sources say:

1. Check the box. Synthient, one of the partners, published a list of 182 device model names seen in the campaign in its public research repository. Its own warning is that a model name alone does not prove infection. Its report centres on MECOOL-branded boxes, one of which it bought and found the backdoor preinstalled on. Plume found more than a dozen different devices contacting the botnet's control server, most of them MECOOL.
2. Do not expect a cleanup. TrendAI says owners cannot remove the implant themselves: it runs as a system app signed with the maker's key, so cleanup needs "vendor action, platform protection or replacement of the device".
3. Factory reset is not a clear fix. Plume recommends a full factory reset because modules may have installed more backdoors, but, as reported, it does not say whether a reset removes x.cpe. Synthient goes further and tells consumers to throw affected boxes away.
4. Isolate in the meantime. For organizations, Synthient recommends finding MECOOL or similar devices with its indicators, disconnecting and discarding any found, blocking the listed control domains and IP addresses, and keeping other smart devices on separate network segments.
5. Remember the source of the problem. Google says the backdoor was loaded after the first boot to get past its compatibility and security tests, so a box can pass certification checks and still carry it.

What happened

GTIG's report, "Shutting the Door on the XCPE Botnet", says Google and industry partners dismantled the backdoor "last week". Besides Google, the participants were Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Reporting by The Hacker News puts the loss of control of the servers in late October.

Google's actions, as it lists them:

• Legal action to take down the domains and servers Videostrong used to control the botnet and install malware modules.
• Legal action against command domains used by over a dozen malware families loaded as modules through the backdoor.
• A ban on Videostrong and any future subsidiaries or affiliates building or selling certified Android devices, or supplying software to other certified vendors.
• Improvements to how firmware integrity is checked on certified Android TV devices.

Google says Videostrong "employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device's first boot", and that it has changed its review process as a result.

How it works

GTIG describes a three-stage design that has been evolving since at least late 2024:

1. Primary backdoor. x.cpe (called com.oemservice in some builds) sits in the firmware partition and runs at the android.uid.system privilege level. If a user uninstalls it, it reinstalls from /oem/ on reboot.
2. Loader. A separate package, com.abc.nexus, runs the modules, with anti-analysis protections. GTIG says the operators later began replacing it with tailored droppers that load single modules, disguised with names like com.android.system.ntp.
3. Monetization modules. Built by other parties that GTIG calls affiliates: residential proxy and bandwidth-sharing software, ad-fraud code, and further backdoors.

For control, the malware first sends an HTTP request for configuration, then keeps an MQTT connection open to receive commands. According to GTIG, those commands include silent app installation, arbitrary shell commands, screen capture and key injection, and network reconnaissance. To install software without consent, the backdoor wipes the consent configuration and disables Google Play Protect's app verification by changing a global setting.

GTIG says its logs show Videostrong's operators using these abilities on victims' devices: capturing live screenshots, injecting keystrokes, exfiltrating account information, package lists and system logs, and setting up reverse shells. Most interactions, though, were module installs, uninstalls and configuration.

Since August 2026, GTIG says, new droppers have used a native exploit to restart the Android debug daemon as root and copy themselves into the system partition, which makes them harder to dislodge.

The numbers

type: bar
title: Devices reached by the disruption
unit: million devices
source: Google Threat Intelligence Group, November 2, 2026 (second figure is a minimum)
XCPE botnet (set-top boxes, GTIG and partners) | 1.3
Further devices cut off from affiliates (at least) | 10

The counts differ by source and snapshot. TrendAI says its telemetry counted 1,472,554 infected devices across 206 models "in more than 170 countries", and notes that partner counts differ because snapshots were taken at different times, so the joint figure is "more than 1.3 million". The Register reports more than 200 countries; we use TrendAI's figure because it is the one stated with its method. TrendAI also recorded more than 3.8 million distinct home and mobile IP addresses connected to the operation between June 3 and October 1.

The Hacker News, citing TrendAI, says Malaysia, Brazil, Iraq, Mexico and Taiwan had the most infected devices, and that the U.S., Germany, the U.K., Australia and Canada had about 26,000 to 42,000 each.

Background

The XCPE case follows BadBox 2.0, another firmware-level botnet that infected more than 10 million TV boxes and other devices before Human, Google and TrendAI disrupted it in March 2025, according to The Register. GTIG calls XCPE part of the same ecosystem: it says some payloads, such as the Moyu and Bird backdoors, were previously tied to BadBox, and that Videostrong's changes in late 2024 may have been a response to earlier Google enforcement.

The business model is the common thread. Residential proxy services sell access to a real household internet connection, so a customer's traffic passes IP-reputation and location checks. TrendAI notes this is why banks, retailers and online services see such traffic as ordinary. GTIG saw as many as three residential-proxy software kits on a single device, and says that shows Videostrong wanted to monetize each infected device as much as possible.

What it means

For buyers. The compromise was in the firmware before the box reached the buyer. GTIG says it found the malware built into "many different device models and brands over multiple years", and The Hacker News reports that Videostrong makes devices under its own name and for other brands, so a brand name is not a reliable guide to who made the firmware.

For platforms. Google admitted a gap in its own tests, loading code after first boot. The fix is in review processes and firmware integrity checks, which only protect future certified devices.

For defenders. Infected devices turned home networks into exit nodes for other people's traffic, so an office with a bring-your-own streaming box can show up in abuse logs. Network segmentation and blocking the published control domains are the options available now.

GTIG itself cautions that "point-in-time disruptions" are not lasting: backdoor operators, ad-fraud rings and residential proxy providers operate as an interconnected supply chain.

What we don't know yet

• Which exact models and firmware versions are infected. Synthient's list has 182 names, TrendAI counts 206 models, and Google has published no list.
• Whether a factory reset removes x.cpe. Sources conflict or are silent.
• Whether the operators or other affiliates will rebuild control infrastructure. Google says the disruption is not the end of its work.
• Videostrong's response. The Register reported that the company did not immediately respond to inquiries.

What to watch next

• Google, Synthient, Plume or TrendAI updating their model and indicator lists.
• Any guidance for owners from Google or the box makers.
• Whether Videostrong-built boxes continue to be sold under other brands.

Sources

• Google Threat Intelligence Group: Shutting the Door on the XCPE Botnet
• TrendAI Research: Helps Disrupt Botnet of More Than 1.3 Million Pre-Infected Set-Top Boxes
• The Hacker News: Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access
• Help Net Security: Google disrupts XCPE botnet, bans the company behind it
• The Register: Cops bust botnet of 1.3M infected Android TV boxes