Google says a TV box maker built a hidden backdoor into its own products, and the code turned more than 1.3 million Android TV set-top boxes into a botnet that the maker rented out to criminals. In a report published on November 2, Google’s Threat Intelligence Group said it and its partners had dismantled the operation, called XCPE, the week before.
Google says the backdoor was not planted by a hacker who broke in later. The manufacturer itself, Videostrong Technology Co., built it in and ran it as a business.
“We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.,” Google wrote.
What Google says happened
Videostrong is an Android original equipment manufacturer and original design manufacturer. It makes Android devices that other brands also sell. Google found the malicious software, a component called x.cpe, built directly into the firmware of many device models and brands over multiple years.
Most infected devices were Android TV set-top boxes, the small streaming boxes people plug into a television. Google also found the same code on telehealth devices, karaoke machines and digital signage displays. The botnet passed 1.3 million devices by Google’s count. TrendAI, one of the security firms on the case, said its own tracking counted 1,472,554 infected devices across 206 models between June 3 and October 1. The two counts use different windows and methods.
How the backdoor worked
The backdoor ran with system-level privileges, the deepest everyday access on an Android device. It sat in the firmware, in some builds under the name com.oemservice. If a user removed it, the device reinstalled it from a protected partition the next time it rebooted.
Once a box started up, the malware contacted a control server and waited for orders. Google says the operators could silently install apps, run commands, capture screenshots, inject keystrokes, and collect account information, device details and system logs. The malware also turned off Google Play Protect, the built-in security check that scans apps.
The money came from selling access. Criminal affiliates paid to load their own modules onto infected boxes. Those modules turned living room devices into residential proxies, routing other people’s internet traffic through a home connection without the owner’s knowledge. Others committed ad fraud or installed still more malware. Google says Videostrong hid the code to slip past certification tests, loading the malicious parts only after a device’s first boot, and kept changing the design, most recently to smaller droppers disguised as system apps.
How researchers traced it to the maker
Synthient, one of Google’s partners, said it traced the operation after finding the backdoor preinstalled on a MECOOL KM9PRO Max Android TV box bought in late 2025. MECOOL is a retail brand linked to Videostrong hardware. In an open directory on one of the botnet’s servers, Synthient found a document by Videostrong’s research and development director, and company email addresses had signed the backdoor software itself.
Google’s findings are an assessment by the company and the firms that worked with it, not a court ruling against Videostrong.
What Google did about it
Google took legal action to take down the domains and servers used to control the botnet, and the control domains of more than a dozen related malware families loaded through the backdoor. Because those operators also spread their malware through other channels, Google estimates the takedown cut off access to at least 10 million additional compromised devices.
Google also cut ties with Videostrong. The company and any future subsidiaries or affiliates are banned from building and selling certified Android devices, and from supplying software to other certified makers. Google said it has changed its review process and is improving how it checks firmware integrity on certified Android TV devices. The work involved Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI.
“A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust,” Google wrote.
The code is still on the boxes
The takedown broke the botnet’s control network, but it did not clean the devices. The backdoor is still in the firmware of the boxes that shipped with it, and it reinstalls itself after a reboot. Security reporting on the case says only clean firmware, if the maker ever provides it, would remove the infection for good. Disconnecting a suspect box from the internet stops it from taking orders in the meantime.
What owners should do
Google did not publish a complete list of affected models, so there is no official lookup for owners. Buy connected devices from reputable manufacturers, and check the official Android TV partner list before buying an unfamiliar brand. Keep Google Play Protect turned on. Be wary of apps that offer payment for sharing your unused bandwidth, because that is how many residential proxy networks recruit devices.
The deeper lesson is about price. A streaming box that costs far less than its rivals has to make money somewhere. In this case, Google says, part of the money came after the sale, from the buyers’ own home networks, without the buyers ever knowing.
Reporting note: This article is based on Google’s Threat Intelligence Group report of November 2, 2026, with independent reporting from BleepingComputer and SecurityWeek. Device counts are the figures reported by Google and TrendAI. Facts were verified on November 4, 2026.