Google kills botnet hidden in 1.3 million certified Android TV boxes, bans maker Videostrong

Google said on November 2 that it has dismantled a botnet called XCPE that ran on more than 1.3 million Android TV set-top boxes, in a post from its Threat Intelligence Group. The unusual part is where it lived. These were boxes that had passed Google's certification, the process that lets a maker ship Google apps. Google assesses "with high confidence" that Shenzhen-based Videostrong Technology Co. "intentionally developed, deployed, and operated" the backdoor for financial gain.

What Google did

Google says it took legal action to take down the domains and servers Videostrong used to control the boxes and push malware, and the command servers used by more than a dozen other malware families loaded through the same backdoor. Cutting those affiliate domains, it says, also severs at least 10 million additional compromised devices. BleepingComputer adds that not all of those devices run Android; they include retail set-top boxes, karaoke machines and telehealth hardware.

Google also cut ties with Videostrong and banned it from making devices with preloaded Google apps. Videostrong and any future subsidiaries or affiliates are barred from building certified Android devices or supplying software to certified vendors. Google says Videostrong used obfuscation to load malicious code after first boot, exploiting a gap in testing, and that it has changed its review process and firmware checks. Partners included Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

The Record reports that Videostrong did not respond to requests for comment, and says Google described the campaign as not "an isolated rogue insider or a development oversight."

Which boxes

Google's post does not name a retail brand as such. Ars Technica reports that the compromised boxes were "mostly sold under the MECOOL brand," and that the security firm Synthient published a list of 182 device model names known to be in the botnet. BleepingComputer says Synthient found the malware preinstalled on a MECOOL KM9PRO Max bought in late 2025. We did not find a statement from MECOOL in any of the coverage we read.

Counts differ by source. Ars reports Trend Micro counted 1,472,554 infected devices, higher than Google's figure, with most in Brazil, Malaysia, Iraq, Mexico and Taiwan and tens of thousands in the US, Germany, the UK, Australia and Canada. The Record puts the footprint at more than 200 countries.

What the boxes were doing

Google says the largest use was residential proxy software, with some devices running as many as three proxy SDKs at once. That means strangers' traffic leaves through the owner's home or office connection. The second use was ad fraud, through hidden browser windows generating ad impressions. The third was a loader: operators sold access to other criminals, who installed their own backdoors. Google says the operators could also run shell commands, capture the screen and inject keystrokes, and Ars adds they could probe other devices on the local network.

The stub app, called x.cpe or com.oemservice, had no malicious code of its own but held system-level permissions. Per Google, it reinstalls from the /oem/ partition after a user removes it and reboots, and it switches off Google Play Protect verification.

The caveat: the boxes are not cleaned

Taking down the servers stops the operators from issuing orders. It does not repair the hardware. Ars reports that Play Protect is still disabled on infected boxes and the now-inert malware modules are still installed as system apps that users cannot easily remove. That is why Google's own advice to "make sure Google Play Protect is active" cannot be followed by an owner of an infected unit: the malware turned it off. Treat that line as prevention for other devices.

What owners should do

• Check the model. If you own a MECOOL box or a white-label Android TV box of unknown origin, compare the model name against Synthient's list of 182 (we did not read the list itself; Ars reports it exists).
• Contain it. BleepingComputer says removal requires clean firmware; the other option it gives is disconnecting the device from the internet. Keep it off any network that carries point-of-sale, payroll or office machines.
• Replace rather than trust. Google recommends buying set-top boxes from reputable manufacturers and points to its Android TV partner list. Note that this very case involved certified hardware, so the list reduces risk but did not prevent it here.
• Be wary of "share your bandwidth" apps and review permissions on third-party VPN and proxy apps, per Google.

Who this hits: any business that put cheap Android boxes behind a lobby TV, a menu board or a waiting-room screen. Ars notes the botnet also reached digital signage, per Google's post, and that Android is open source, so Videostrong could keep selling uncertified boxes under other names. Without Google's apps, Ars says, it would have to rebuild its operation from scratch.

Sources: Google Threat Intelligence Group (Nov. 2, 2026); Ars Technica (Nov. 3); BleepingComputer (Nov. 2); The Record (Nov. 3). This is general information, not investment or security-product advice.