# Google Bans Videostrong Over XCPE Botnet Backdoor in 1.3M TV Boxes

- URL: https://usa-24.com/xcpe-botnet-android-tv-box-backdoor/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-11-05T16:13:44.030Z
- Updated: 2026-11-05T16:13:44.038Z
- Topics: XCPE Botnet, Android TV Boxes, Malware, Supply Chain Security, Google, IoT Security

> Google dismantled the XCPE botnet, a firmware backdoor in more than 1.3 million mostly Android TV boxes, and banned the Chinese maker it blames, Videostrong.

## Key takeaways

- Google and its partners disrupted the XCPE botnet, which Google says enrolled more than 1.3 million mostly Android TV set-top boxes.
- Google banned Videostrong and its future subsidiaries and affiliates from making certified Android devices.
- The backdoor ran in firmware with system-level privileges and reinstalled itself from the /oem/ partition after removal, according to Malwarebytes.
- Certified and uncertified boxes both turned up in the botnet, so a Google certification label did not guarantee safety.
- Synthient advises consumers to discard affected boxes, and McAfee warns a factory reset may not remove the backdoor.

Google says a single botnet had taken over more than 1.3 million devices, most of them inexpensive Android TV set-top boxes, and the malware was built into their firmware before any buyer plugged one in. On November 2, 2026, Google disclosed that it had helped dismantle the network, which researchers call XCPE, and banned the Shenzhen-based maker it blames, Videostrong Technology. For US households that bought a cheap streaming box, this is less a story about a distant criminal network than about a device that may already sit on a home network with hidden access.

Google's Threat Intelligence Group said it assesses "with high confidence" that the backdoor and botnet were "intentionally developed, deployed, and operated for financial gain" by Videostrong, according to [Security Affairs](https://securityaffairs.com/202323/malware/inside-xcpe-the-botnet-that-turned-1-3m-set-top-boxes-into-proxy-servers.html). That attribution places the problem at the manufacturing level. It points to the factory, not to a single owner who made a bad choice.

## What Google found inside the XCPE botnet

Reports place the takedown in late October, when Google and its partners cut the botnet off from its servers, according to [The Hacker News](https://thehackernews.com/2026/11/google-disrupts-13-million-device.html). Google made the findings public on November 2, a few days later.

The business model is the part that stands out. Criminal affiliates paid Videostrong for access and then loaded their own malware modules onto the boxes, according to [BetaNews](https://betanews.com/article/google-bans-videostrong-xcpe-tv-box-botnet/). The maker sold a foothold, and the criminals who bought it did the rest.

Ad fraud and residential proxy abuse were the main ways the operators made money. In a residential proxy scheme, criminals route their traffic through the home internet connections of the people who own the devices, which makes that traffic appear to come from an ordinary household, as [McAfee](https://www.mcafee.com/blogs/security-news/xcpe-botnet-android-tv-box/) explains.

The 1.3 million figure is only part of the picture. Google estimates that shutting down the affiliates' command domains cuts criminals off from at least 10 million more compromised devices, which were infected through other routes and malware families, according to [Help Net Security](https://www.helpnetsecurity.com/2026/11/02/xcpe-botnet-android-backdoor/). Those machines are a separate problem, but they reflect the same underlying risk of cheap hardware on home networks.

## How the backdoor hides in firmware and survives removal

According to [Malwarebytes](https://www.malwarebytes.com/blog/mobile/2026/11/a-hidden-backdoor-put-1-3-million-tv-boxes-to-work-for-criminals), the backdoor ran in firmware with system-level privileges, a level of control a normal app never gets. After removal, it reinstalled itself from the /oem/ partition. That behavior is why removing a visible app is unlikely to be enough.

Google's account of the testing matters just as much. The company says Videostrong got past its compatibility and security tests by loading the malicious code after first boot. In other words, the device looked clean when it was checked and changed afterward, a sequence that certification testing is poorly placed to catch.

The reset question is where accounts diverge. Some reports say the backdoor stays on infected devices, and McAfee says a factory reset may not remove it because the code lives in protected firmware. Treat a reset as an unreliable fix, not a cure.

## Which brands and devices are tied to the botnet

Videostrong is the only maker Google has named, but the malware turned up in other products as well. The table summarizes the main findings in the coverage.

| Device or maker | What researchers found | Reported by |
|---|---|---|
| Videostrong Technology | Google says it built the backdoor and sold access to criminals. Its website still listed "Google Certified Android TV Box" and "Google Certified Android TV Stick" products as of November 2. | The Hacker News, SQ Magazine |
| MECOOL-branded boxes | Synthient found the same malware. The reporting says these boxes are sold by a company listed in China, Skyworth Technology. | BetaNews, iTnews |
| Google-certified and uncertified boxes | Plume found both kinds inside the botnet. | McAfee, SQ Magazine |
| Telehealth devices, karaoke machines and digital signage | Google found the malware in these products in addition to TV boxes. | Security Affairs, iTnews |

The MECOOL finding is the only one with a named consumer brand, so it is the first thing to check on a box. iTnews also reported infected Android TV boxes in Australia, which shows the problem is not confined to one country.

BetaNews reports that Synthient's founder considers the 1.3 million count a low estimate, so the true number may be higher. The sources do not say how many US devices are affected or which US retailers sold the boxes. Buyers have no public list to check a purchase against, which leaves the box's brand and firmware as the only practical clues.

## Why Google certification did not protect buyers

Google certification signals that a device met the company's requirements, and shoppers reasonably lean on that label. XCPE shows the signal can fail. Certified and uncertified boxes both turned up in the botnet, according to [SQ Magazine](https://sqmagazine.co.uk/google-videostrong-xcpe-backdoor-tv-box-botnet/) and McAfee. Videostrong's own site still listed certified products as of November 2.

Google's response has two parts. It banned Videostrong and any future subsidiaries and affiliates from making certified Android devices, and it tightened firmware integrity checks for certified Android TV hardware. Those steps strengthen the program going forward. They do not reach the boxes already in living rooms, and the sources do not say whether the new checks will.

The pattern is not new. [Dr.Web previously reported 1.3 million older Android streaming boxes infected with the Vo1d backdoor](https://www.techradar.com/pro/security/millions-of-android-streaming-boxes-hit-by-damaging-malware), and Google said those devices were off-brand and not Play Protect certified. No date is attached to that TechRadar report in the coverage available, so treat it as background rather than as a fresh data point.

## How to check your TV box and what to do now

The steps below draw on McAfee's guidance and Synthient's advice.

- Check the brand. Treat any MECOOL-branded box, or any box linked to Videostrong, as suspect.
- Look for the backdoor app described in McAfee's guide before you assume the box is clean.
- Do not rely on a factory reset. The sources disagree on whether it removes the backdoor, and McAfee warns it may not.
- Install firmware and system updates only from the device maker, and avoid unbranded boxes.
- If the box is linked to the botnet, Synthient advises discarding it rather than trying to repair it.

Google certification is a starting point, not a guarantee. When you replace a box, choose a model whose maker you can identify and whose updates clearly come from that maker.

## What to watch next for TV boxes and the supply chain

Several open questions will shape what happens next. Videostrong has not publicly contested the attribution or the ban in the reporting so far. Google's 10 million device figure describes devices whose criminal access it cut off, which is not the same as devices cleaned up. The tightened firmware checks may matter most for new hardware if they do not reach boxes already sold.

The enforcement pattern resembles other recent cases. The FBI's seizure of the [Virtualine domain](https://usa-24.com/virtualine-fbi-seizure-bulletproof-hosting/) disrupted a bulletproof hosting provider by targeting the infrastructure criminals depend on. The [Trezor warning to Safe 5 buyers](https://usa-24.com/trezor-safe-5-implant-cryptobilis/) about a suspected implant shows how a compromised device can turn into an urgent consumer problem.

For a US household, the most useful check is simple: find out whose brand is on the box in the living room and whether that company can explain where its firmware came from. The XCPE case suggests that answer may matter more than the store where the box was bought.

## Frequently asked questions

### Is my Android TV box hacked?

Start by checking the brand. Boxes branded MECOOL, or any box linked to Videostrong, should be treated as suspect. McAfee's guide describes looking for the backdoor app on the device, but a clean-looking device does not prove the box is safe.

### Does a factory reset remove the XCPE backdoor?

The reports disagree. Malwarebytes describes the backdoor reinstalling itself from the /oem/ partition after removal, and McAfee says a factory reset may not remove it because the code lives in protected firmware. Do not treat a reset as a fix.

### Which TV box brands are linked to the XCPE botnet?

Google named Videostrong Technology, a Shenzhen-based maker it banned. Synthient found the same malware in MECOOL-branded boxes, which the reporting says are sold by a company listed in China, Skyworth Technology. Plume found both Google-certified and uncertified boxes in the botnet.

### Should I throw away my TV box if it might be infected?

Synthient advises consumers to discard affected boxes, and that is the safest option if your box matches one of the reported brands or links. Replace it with a device from a maker you can identify, and install updates only from that maker.

## Sources

1. [Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access — The Hacker News](https://thehackernews.com/2026/11/google-disrupts-13-million-device.html)
2. [Google disrupts XCPE botnet, bans the company behind it — Help Net Security](https://www.helpnetsecurity.com/2026/11/02/xcpe-botnet-android-backdoor/)
3. [A hidden backdoor put 1.3 million TV boxes to work for criminals — Malwarebytes](https://www.malwarebytes.com/blog/mobile/2026/11/a-hidden-backdoor-put-1-3-million-tv-boxes-to-work-for-criminals)
4. [Google cuts off TV box maker Videostrong over backdoor in 1.3M devices — BetaNews](https://betanews.com/article/google-bans-videostrong-xcpe-tv-box-botnet/)
5. [Inside XCPE, the botnet that turned 1.3M set-top boxes into proxy servers — Security Affairs](https://securityaffairs.com/202323/malware/inside-xcpe-the-botnet-that-turned-1-3m-set-top-boxes-into-proxy-servers.html)
6. [Chinese Videostrong botnet hit Android TV boxes in Australia: researchers — iTnews](https://www.itnews.com.au/news/chinese-videostrong-botnet-hit-android-tv-boxes-in-australia-researchers-630083)
7. [XCPE Botnet: Is Your Android TV Box Hacked? What to Do Now — McAfee](https://www.mcafee.com/blogs/security-news/xcpe-botnet-android-tv-box/)
8. [Google Disrupts Massive Android TV Botnet, Bans Device Maker — SQ Magazine](https://sqmagazine.co.uk/google-videostrong-xcpe-backdoor-tv-box-botnet/)
9. [Millions of Android streaming boxes hit by damaging malware — TechRadar](https://www.techradar.com/pro/security/millions-of-android-streaming-boxes-hit-by-damaging-malware)