Google cuts off a botnet of 1.3 million Android TV boxes built in at the factory

XCPE is a backdoor, which is a hidden door that lets an outsider into a device. It was built into the firmware of the boxes. Firmware is the basic software a device carries from the moment it is made.

Most botnets get in later. A person clicks a bad link, or a bug is exploited. XCPE was different, because it was already there when the box came out of the package.

The backdoor ran with system-level privileges, which means it had the same powers as the device itself. Security researchers found it spread across many models and brands over several years.

Google's Threat Intelligence Group says it assesses "with high confidence" that Videostrong Technology Co. built and ran the backdoor for money. Videostrong is a hardware maker based in Shenzhen, China. It builds home TV boxes and projectors.

Google says this was not a rogue employee or a coding slip. In its words, the campaign "wasn't an isolated rogue insider or a development oversight." Videostrong had not responded to requests for comment when the news broke.

These are Google's findings, not a court ruling. Google acted on them right away.

The backdoor was a platform. Google says Videostrong sold access to criminal affiliates, who then loaded their own malicious add-ons, called modules, onto the infected boxes.

Those modules did three main jobs:

• Ad fraud: they generated fake ad views, opened hidden web pages and clicked ads, so advertisers paid for traffic no person ever saw.
• Residential proxies: they pushed other people's internet traffic through your home connection. A residential proxy is a service that hides someone's activity behind an ordinary home IP address.
• More malware: they installed other backdoors that could download and run further harmful programs.

In real life Think of a rented car with a stranger's cargo in the trunk. You pay for the electricity and the internet, and a criminal uses your connection to look like a normal household.

Once a box started up, XCPE contacted a control server to get a link to a message system called MQTT. Operators used that link to send commands.

According to Google's analysis, the operators could:

• Install apps: silently download and install more Android applications.
• Run commands: execute scripts with system privileges.
• Watch the screen: capture screenshots and inject keystrokes.
• Collect data: read account details, device details, app lists and system logs.
• Explore the network: probe the home network and open remote shell sessions, which are direct command lines into the device.

Security firm TrendAI described the preinstalled management tool as posing as an ordinary remote-management client. It gave the operator full control of each box. Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses connected to the operation.

Google worked with Japan's National Police Agency and the security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. Together they analyzed the malicious servers and shut them down.

The group also went after the servers that run the affiliates' modules. Google says those affiliates sell through other channels too, so taking down their servers cuts access to at least 10 million additional compromised devices. Some of those are not Android devices.

The devices named in the reports include retail set-top boxes, karaoke machines, telehealth hardware and digital signage. Synthient says it traced the backdoor after finding it preinstalled on a MECOOL KM9PRO Max box bought in late 2025.

Google names several residential proxy services whose software it found on infected boxes: Linkfog, AppSalt/Honeygain, GaGaNode, NetNut and Traffmonetizer. The software routed third-party internet traffic through the boxes without their owners' knowledge or consent.

The ad-fraud modules and the extra backdoors had names too. Google lists Moyu, Spirit and Bird among the backdoors that downloaded and ran more malware.

Why it matters: XCPE itself was only the front door. Each affiliate brought its own tool, so one infected box could serve several criminal businesses at once.

Synthient says it traced the backdoor and its servers back to Videostrong after finding the malware preinstalled on a MECOOL KM9PRO Max box, bought in late 2025.

The control system leaned on a few web domains. Google says the malware used different subdomains of one domain, anyevonline[.]com, depending on the Android version and the type of device. That is part of how the team mapped the network and then shut it down.

Mapping the servers is what made a coordinated takedown possible. Several companies and a national police agency each saw a slice of the picture, and together they could act at once.

Google ended its relationship with the company. It revoked Videostrong's license to make Android TV devices with Google apps and services preloaded.

It also banned Videostrong and its future affiliates from making certified Android devices or supplying software to certified makers. Certified means a device passed Google's checks and is allowed to ship with Google's apps.

Google says Videostrong got past those checks with obfuscation, which is a way of hiding code so reviewers cannot read it easily. The code was loaded only after a device booted for the first time. Google says it has changed its review process for device makers as a result.

The takedown cut the operators off. It did not clean the boxes already sitting in living rooms.

The catch: the malware can reinstall itself from a protected storage area on the box, called the /oem/ partition, if someone deletes it. The only fixes are clean firmware or taking the box off the internet.

Security researchers also say the operators kept changing their tools. In late 2024 they added a separate loader, and since August 2026 they have swapped it for small droppers disguised as Android system apps.

No. XCPE belongs to the same ecosystem as BadBox 2.0, another botnet that infected more than 10 million TV boxes and other devices. Human, Google and TrendAI disrupted that one in March 2025.

The pattern is the same: cheap devices, firmware nobody checks, and a business model built on selling access to the buyer's home connection.

• Know your box: if you own a cheap Android TV box from a little-known brand, find its exact model and look for security notices about it.
• Prefer certified devices: a device that carries Google's certification and comes from a known retailer has had at least some checks.
• When in doubt, unplug: if you cannot confirm a box is clean, disconnect it from the internet. A box with no connection cannot take orders.
• Watch for odd behavior: unexplained slow internet or apps you did not install are worth a closer look.