Google says Shenzhen-based Android TV box maker Videostrong Technology Co. built a backdoor into its own firmware. Called XCPE, it enrolled more than 1.3 million set-top boxes into a botnet. Google has taken down its control servers and banned Videostrong from certified Android.
For owners, the problem isn’t over. The backdoor is still in the boxes’ firmware. Google’s analysis found it reinstalls itself from the device’s /oem/ partition on reboot if someone uninstalls it. In other words, owners can’t simply remove it themselves.
A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users.
That line comes from Google’s Threat Intelligence Group report, published on November 3. Google says it has high confidence that Videostrong built and ran the botnet on purpose, for financial gain.
What owners of these Android TV boxes can do
Researchers have tied the campaign to MECOOL-branded boxes, which security firm Synthient attributes to Videostrong. Synthient bought a MECOOL KM9PRO Max in late 2025. It found the backdoor preinstalled, running as com.oemservice.
The researchers don’t agree on a fix, so here are their positions side by side:
- Synthient: get rid of these devices permanently, because they carry a high risk of containing more malware. It also wants them pulled from online stores.
- Plume (via The Hacker News): do a full factory reset. Plume doesn’t say whether a reset removes the x.cpe backdoor itself.
- TrendAI (via The Hacker News): cleanup needs vendor action, platform protection or a replacement device.
Our take: Google’s finding that the backdoor reinstalls from /oem/ is a good reason not to treat a factory reset as a cure. We wouldn’t call these boxes safe.
Synthient has also published a list of model names seen in the campaign. The Hacker News puts it at 182 models. It warns that a matching model name alone doesn’t prove a box is infected.
What the XCPE backdoor could do
With system-level access, the backdoor could:
- Install apps silently
- Switch off Google Play Protect’s app verification
- Run any shell command with system privileges
- Capture the screen and inject keystrokes
- Scan the local network
Google says it watched operators take live screenshots and open reverse shells. They also pulled account details, device information and system logs off the boxes.
Videostrong made money by selling access to criminal affiliates. Their modules ran ad fraud and loaded more malware. They also turned boxes into residential proxies for other people’s traffic. TV boxes weren’t the only targets either. Google also found the backdoor on telehealth devices, karaoke machines and digital signage.
Where the infected boxes are
Google’s map shows infections around the world. The heaviest shading sits over Brazil, Iraq, Mexico and Southeast Asia.
TrendAI, one of Google’s partners, has its own count, reported by The Hacker News. It saw 1,472,554 infected devices across 206 models between June 3 and October 1. That is TrendAI’s tally, separate from Google’s 1.3 million figure. The top five countries were Malaysia, Brazil, Iraq, Mexico and Taiwan. In the US, Germany, the UK, Australia and Canada, each country had roughly 26,000 to 42,000.
What Google did, and the gap it admits
Google took legal action against Videostrong’s control servers. It also targeted the control domains of more than a dozen malware families loaded through the backdoor. Google estimates this cuts off access to at least 10 million more compromised devices.
Videostrong and any future affiliates can no longer build certified Android devices or supply software to certified vendors. Google is also tightening firmware checks on certified Android TV devices.
Google is open about its own miss. It says Videostrong used obfuscation to exploit a gap in its tests, loading the malicious code only after the first boot. Google says it has since changed its review process. That gap matters, because buyers trusted these boxes as Google-certified hardware.
As of November 3, Videostrong’s website still lists products named Google Certified Android TV Box and Google Certified Android TV Stick. For anyone shopping for a cheap streaming box, a certification label on its own is no guarantee.
Factory-installed malware keeps turning up in budget hardware. We’ve covered Midnight Mimosa on cheap Android phones and the first malware built for Android car head units.
Sources: Google Threat Intelligence Group, Synthient, The Hacker News
