Android TV Box Malware: Google Bans Videostrong Over XCPE Botnet

Google has banned Chinese device maker Videostrong Technology after linking it to Android TV box malware that turned more than 1.3 million streaming set-top boxes into a botnet. Google’s Threat Intelligence Group said on November 2 that it assesses “with high confidence” that Videostrong built, deployed and ran the backdoor, known as XCPE, for profit.

Google and its partners took the botnet’s servers offline last week. Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI worked on the takedown.

How the Android TV box malware worked

According to Google’s technical report, the backdoor was preloaded in the firmware of certified Android TV boxes and ran with system-level privileges. It appears as x.cpe or com.oemservice depending on the build. If a user uninstalls it, it reinstalls itself from a protected partition on the next reboot.

The malware also switched off Google Play Protect app verification so it could silently download and run new code. Google says Videostrong used obfuscation to slip past its certification tests by loading the malicious code only after the device’s first boot.

Videostrong then sold access to the boxes to criminal “affiliates”, who loaded their own modules. These ran hidden ad fraud, quietly turned home connections into residential proxy exit nodes and installed more malware. Help Net Security reports that operators could also take screenshots, inject keystrokes and open a shell on the devices.

Most infected devices were Android TV set-top boxes, but Google also found the backdoor on telehealth devices, karaoke machines and digital signage. Google’s analysis shows the malware checks whether a device identifies itself as a Mecool model, a box brand linked to Videostrong.

What Google did about it

Google said the campaign “wasn’t an isolated rogue insider or a development oversight”, calling it “an unacceptable breach of trust”. Its response includes:

• Legal action to take down the domains and servers used to control the botnet and push malware modules.
• Legal action against the command servers of more than a dozen malware families delivered through the backdoor, which Google says cuts off access to at least 10 million more compromised devices.
• A ban on Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors.
• Tighter firmware integrity checks for certified Android TV devices.

The case echoes the BadBox 2.0 botnet the FBI warned about in 2025, which also relied on cheap, preinfected streaming boxes. This time, though, the boxes carried Google’s certification.

What owners of these boxes should do

The takedown cuts the botnet off from its servers, but it does not remove the code. BleepingComputer notes that a factory reset or uninstall will not clean an infected box, because the backdoor reinstalls itself. Owners would need clean firmware, or should disconnect the device from the internet.

If you own a cheap Android TV box, especially a Mecool model, the safest move is to replace it with a box from a well-known brand that still gets updates. Google says buyers should stick to reputable manufacturers listed on its Android TV partner page, keep Play Protect turned on and avoid apps that pay you to “share” unused bandwidth.

Connected devices in homes and shops keep showing up in attacks, from this botnet to the recent supermarket cyberattack that hit freezers in Belgium and Sweden. Smartphones are targets too, as a recent mercenary spyware case in Germany showed.