Android TV Boxes Turned Into a Massive Botnet After Manufacturer Allegedly Sold Hacker Access
Google and several cybersecurity partners have disrupted a massive Android botnet that affected more than 1.3 million devices, mostly Android TV boxes.
According to Google's Threat Intelligence Group, the Chinese device manufacturer Videostrong Technology Co. allegedly built a hidden backdoor into devices and sold access to cybercriminals.
The criminals used infected devices for advertising fraud, unauthorised internet traffic routing, and other malicious activities—all without the owners' knowledge.
Google says it has taken legal action to shut down the servers controlling the botnet and has banned Videostrong from manufacturing certified Android devices or supplying software to other certified manufacturers.
The operation is known as XCPE.
What Happened? A Manufacturer Allegedly Put Malware Inside Its Own Devices
Most malware infections happen when users download suspicious applications, visit unsafe websites, or click malicious links.
However, the XCPE botnet worked differently.
Google says the malware was built directly into the firmware of Android devices during manufacturing. This means some devices were already compromised before customers purchased them.
The main backdoor was identified as x.cpe, also known in some versions as com.oemservice.
Google believes the operation was deliberately developed and operated for financial gain rather than being the result of an isolated employee or accidental software mistake.
The affected devices included:
Android TV set-top boxes
Streaming devices
Telehealth equipment
Karaoke machines
Digital signage devices
The malware appeared across multiple device brands and models over several years.
How Did the XCPE Botnet Work?
The malware operated quietly in the background and connected infected devices to remote servers controlled by its operators.
These servers, known as command-and-control (C2) servers, allowed criminals to send instructions to compromised devices.
Once connected, the attackers could perform several activities remotely.
According to Google's investigation, the backdoor could:
Install additional applications without the owner's permission.
Execute commands with system-level privileges.
Capture screenshots of the device.
Collect device information, account details, and system logs.
Investigate the local network.
Download and run additional malware.
Disable certain Google Play Protect checks.
In simple terms, criminals could use infected devices as remotely controlled machines without their owners realizing what was happening.
What Did Criminals Do With the Infected Devices?
Google says Videostrong sold access to criminal affiliates, who installed additional malicious software modules on compromised devices.
These modules were used for several types of cybercrime.
1. Advertising Fraud
Some infected devices were used to generate fake advertising activity.
The malware could load hidden webpages, create artificial ad impressions, and interact with advertisements.
This allowed criminals to generate fraudulent advertising revenue.
2. Residential Proxy Networks
Another major use was turning infected devices into residential proxies.
A residential proxy allows someone to route internet traffic through another person's home internet connection.
For example, a criminal could send internet requests through an infected TV box, making the traffic appear to come from an ordinary household rather than the criminal's actual location.
The device owner might not notice this activity, even though their internet connection was being used without permission.
3. Installing More Malware
The backdoor also allowed criminal affiliates to install additional malicious programs.
Some of these programs could introduce further backdoors, creating additional security risks.
This made the XCPE operation more than a traditional botnet. It became a platform through which different criminal groups could use compromised devices for their own purposes.
More Than 1.3 Million Devices Were Affected
Cybersecurity company TrendAI identified 1,472,554 infected devices across 206 models between June 3 and October 1, 2026.
The researchers found affected devices in several countries.
Some of the countries with the highest numbers included:
Malaysia
Brazil
Iraq
Mexico
Taiwan
The United States, Germany, the United Kingdom, Australia, and Canada also had thousands of affected devices.
Most infections involved Android TV boxes, but the investigation also identified other connected devices.
Importantly, Google's broader disruption may have a much larger impact. The company estimates that shutting down control domains used by related malware families could cut off access to at least 10 million additional compromised devices.
These additional devices are not all part of the 1.3-million-device XCPE botnet. They were connected to other malware operations that shared related infrastructure.
Google Takes Action Against Videostrong
Google worked with several cybersecurity organisations and law enforcement partners to disrupt the operation.
The partners included:
Japan's National Police Agency
Lumen
HUMAN Security
Plume
Synthient
TrendAI
Google also took several important actions:
Used legal action to take down the domains and servers controlling the XCPE botnet.
Disrupted command-and-control domains used by more than a dozen malware families.
Cut ties with Videostrong.
Banned Videostrong and its future subsidiaries or affiliates from manufacturing certified Android devices.
Prevented the company from supplying software to other certified device manufacturers.
Improved its firmware review and security testing process.
Google says the changes are intended to prevent manufacturers from hiding malicious code in device firmware and installing it after the first startup.
Is Your Android TV Box Safe?
This is one of the most important questions for Android TV box owners.
Google's announcement does not mean every Android TV box is infected. However, some devices and models were found to contain the XCPE backdoor.
Cybersecurity researchers at Synthient published a list of 182 device model names associated with the campaign. MECOOL-branded devices received particular attention during the investigation.
However, a model name appearing on the list does not automatically prove that a particular device is infected.
Owners should take the following precautions:
Check whether their device model appears in the published research.
Contact the manufacturer and ask whether a clean firmware update is available.
Avoid installing unofficial firmware or applications from unknown websites.
Disconnect a suspicious device from the internet while investigating it.
Do not use a potentially compromised device to access sensitive accounts or services.
Can a Factory Reset Remove the Malware?
Unfortunately, a normal factory reset may not completely solve the problem.
The reason is that the XCPE backdoor was embedded in the device firmware. Google and security researchers explain that removing the malware from the regular Android application area may not work because it can reinstall itself from a protected firmware partition after a reboot.
Plume recommends a factory reset because additional malware may have been installed. However, that does not guarantee that the original backdoor will be removed.
A clean firmware replacement or device replacement may be necessary, depending on the model and the manufacturer's support.
If you suspect your device is affected, disconnect it from the internet and seek guidance from the manufacturer or a qualified security professional.
Google Also Found a Gap in Its Android Security Testing
The incident raises questions about how malicious software managed to enter devices that were marketed as certified Android products.
Google says Videostrong used obfuscation techniques to avoid detection during security checks. The company allegedly loaded malicious code after the device completed its first startup.
This allowed the malware to bypass parts of Google's existing review process.
Google says it has updated its testing procedures and is improving how it checks the firmware used in certified Android TV devices.
The incident highlights an important security issue: a device can pass certain certification checks and still become dangerous if its manufacturer secretly changes its software afterward.
Why This Incident Matters
The XCPE botnet is a serious example of a supply-chain security problem.
Usually, users are advised to avoid suspicious downloads and install security updates. But those steps may not protect someone when malware is already built into the device before purchase.
This incident also shows how everyday smart devices can become part of a much larger cybercrime network.
An Android TV box may look like a simple entertainment device, but it is still a computer connected to a home network. If compromised, it can potentially be used to carry out activities that put the owner's privacy and network security at risk.
For consumers, the lesson is clear: choosing a device from a reputable manufacturer and checking its software support are important parts of staying safe.
Final Thoughts
Google's disruption of the XCPE botnet is an important step in fighting cybercrime involving connected devices.
However, shutting down the criminal servers does not automatically remove the malware from every infected device. Owners of potentially affected Android TV boxes should remain cautious and check for official guidance from their manufacturers.
The bigger concern is that malicious software may have been deliberately included in consumer devices during manufacturing.
As smart TVs, streaming boxes, and other connected products become more common, manufacturers must take firmware security and user privacy seriously.
A device should not become a security threat simply because someone plugged it into their television and connected it to the internet.
Sources and Further Reading
Google Threat Intelligence Group – Shutting the Door on the XCPE Botnet
The Hacker News – Google Disrupts 1.3 Million-Device Android Botnet
0 Comments