Google Bans Videostrong Over XCPE Botnet Backdoor in 1.3M TV Boxes

Google says a single botnet had taken over more than 1.3 million devices, most of them inexpensive Android TV set-top boxes, and the malware was built into their firmware before any buyer plugged one in. On November 2, 2026, Google disclosed that it had helped dismantle the network, which researchers call XCPE, and banned the Shenzhen-based maker it blames, Videostrong Technology. For US households that bought a cheap streaming box, this is less a story about a distant criminal network than about a device that may already sit on a home network with hidden access.

Google's Threat Intelligence Group said it assesses "with high confidence" that the backdoor and botnet were "intentionally developed, deployed, and operated for financial gain" by Videostrong, according to Security Affairs. That attribution places the problem at the manufacturing level. It points to the factory, not to a single owner who made a bad choice.

What Google found inside the XCPE botnet

Reports place the takedown in late October, when Google and its partners cut the botnet off from its servers, according to The Hacker News. Google made the findings public on November 2, a few days later.

The business model is the part that stands out. Criminal affiliates paid Videostrong for access and then loaded their own malware modules onto the boxes, according to BetaNews. The maker sold a foothold, and the criminals who bought it did the rest.

Ad fraud and residential proxy abuse were the main ways the operators made money. In a residential proxy scheme, criminals route their traffic through the home internet connections of the people who own the devices, which makes that traffic appear to come from an ordinary household, as McAfee explains.

The 1.3 million figure is only part of the picture. Google estimates that shutting down the affiliates' command domains cuts criminals off from at least 10 million more compromised devices, which were infected through other routes and malware families, according to Help Net Security. Those machines are a separate problem, but they reflect the same underlying risk of cheap hardware on home networks.

How the backdoor hides in firmware and survives removal

According to Malwarebytes, the backdoor ran in firmware with system-level privileges, a level of control a normal app never gets. After removal, it reinstalled itself from the /oem/ partition. That behavior is why removing a visible app is unlikely to be enough.

Google's account of the testing matters just as much. The company says Videostrong got past its compatibility and security tests by loading the malicious code after first boot. In other words, the device looked clean when it was checked and changed afterward, a sequence that certification testing is poorly placed to catch.

The reset question is where accounts diverge. Some reports say the backdoor stays on infected devices, and McAfee says a factory reset may not remove it because the code lives in protected firmware. Treat a reset as an unreliable fix, not a cure.

Which brands and devices are tied to the botnet

Videostrong is the only maker Google has named, but the malware turned up in other products as well. The table summarizes the main findings in the coverage.

The MECOOL finding is the only one with a named consumer brand, so it is the first thing to check on a box. iTnews also reported infected Android TV boxes in Australia, which shows the problem is not confined to one country.

BetaNews reports that Synthient's founder considers the 1.3 million count a low estimate, so the true number may be higher. The sources do not say how many US devices are affected or which US retailers sold the boxes. Buyers have no public list to check a purchase against, which leaves the box's brand and firmware as the only practical clues.

Why Google certification did not protect buyers

Google certification signals that a device met the company's requirements, and shoppers reasonably lean on that label. XCPE shows the signal can fail. Certified and uncertified boxes both turned up in the botnet, according to SQ Magazine and McAfee. Videostrong's own site still listed certified products as of November 2.

Google's response has two parts. It banned Videostrong and any future subsidiaries and affiliates from making certified Android devices, and it tightened firmware integrity checks for certified Android TV hardware. Those steps strengthen the program going forward. They do not reach the boxes already in living rooms, and the sources do not say whether the new checks will.

The pattern is not new. Dr.Web previously reported 1.3 million older Android streaming boxes infected with the Vo1d backdoor, and Google said those devices were off-brand and not Play Protect certified. No date is attached to that TechRadar report in the coverage available, so treat it as background rather than as a fresh data point.

How to check your TV box and what to do now

The steps below draw on McAfee's guidance and Synthient's advice.

• Check the brand. Treat any MECOOL-branded box, or any box linked to Videostrong, as suspect.
• Look for the backdoor app described in McAfee's guide before you assume the box is clean.
• Do not rely on a factory reset. The sources disagree on whether it removes the backdoor, and McAfee warns it may not.
• Install firmware and system updates only from the device maker, and avoid unbranded boxes.
• If the box is linked to the botnet, Synthient advises discarding it rather than trying to repair it.

Google certification is a starting point, not a guarantee. When you replace a box, choose a model whose maker you can identify and whose updates clearly come from that maker.

What to watch next for TV boxes and the supply chain

Several open questions will shape what happens next. Videostrong has not publicly contested the attribution or the ban in the reporting so far. Google's 10 million device figure describes devices whose criminal access it cut off, which is not the same as devices cleaned up. The tightened firmware checks may matter most for new hardware if they do not reach boxes already sold.

The enforcement pattern resembles other recent cases. The FBI's seizure of the Virtualine domain disrupted a bulletproof hosting provider by targeting the infrastructure criminals depend on. The Trezor warning to Safe 5 buyers about a suspected implant shows how a compromised device can turn into an urgent consumer problem.

For a US household, the most useful check is simple: find out whose brand is on the box in the living room and whether that company can explain where its firmware came from. The XCPE case suggests that answer may matter more than the store where the box was bought.