Google and a coalition of security partners have disrupted a botnet of more than 1.3 million Android devices, most of them television set-top boxes, and Google says the infection was not an accident. In a report published on Monday, November 2, the Google Threat Intelligence Group said it assesses with high confidence that Videostrong Technology Co., a device maker based in Shenzhen, China, intentionally developed, deployed and operated the backdoor for financial gain, then sold access to criminal affiliates.
The operation, known as XCPE, differed from a typical botnet in one important way: the malicious software was built directly into device firmware during manufacturing. Google said it found the software in many different device models and brands over several years. The main component, tracked as x.cpe and also named com.oemservice, runs with system-level privileges on Android. Once a box was connected, it contacted command servers for instructions, and operators could silently install other applications, disable Google Play Protect, run system commands, capture screenshots, inject keystrokes and collect information about the device and its accounts.
That access became a platform other criminals could rent. According to Google, affiliates loaded modules that turned household boxes into residential proxies, routing other people's internet traffic through the owners' home connections without their knowledge. Other modules carried out advertising fraud by generating impressions and loading hidden pages, and still others installed additional backdoors. Google named proxy services linked to the modules, including Linkfog, AppSalt/Honeygain, NetNut and Traffmonetizer. TrendAI, one of the partners in the disruption, counted 1,472,554 infected devices across 206 models between June 3 and October 1, and described that figure as a lower bound.
The evidence came in part from Synthient, which said it first found the malware preinstalled on a MECOOL KM9PRO Max box bought in late 2025. MECOOL is a Videostrong brand; the company also builds devices for other labels. Synthient found a publicly accessible directory on an operator server containing a document signed by Videostrong's research and development director, and Videostrong company email addresses had been used to sign the backdoor code. Google said Videostrong's own domain pointed to the same internet address as a command server for the botnet.
Google worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI on the takedown, carried out in late October. Legal action brought down the domains and servers controlling XCPE, along with the control domains of more than a dozen malware families distributed through it. Because those affiliates also spread their software through other channels, Google estimates the action will sever criminal access to at least 10 million additional compromised devices, a group that includes karaoke machines, telehealth equipment and digital signage as well as TV boxes.
Google has also cut ties with Videostrong entirely. It and any future subsidiaries or affiliates are banned from building or selling certified Android devices or supplying software to other certified makers, and its license to ship devices with preloaded Google apps has been revoked. Google said Videostrong hid its code to slip past certification testing, loading malicious components after a device's first boot, and that it has since changed its review process. Videostrong did not immediately respond to inquiries from The Register.
The takedown, however, does not clean the boxes already in people's homes. The backdoor remains in the firmware and reinstalls itself from a protected partition when someone tries to remove it, so owners cannot simply uninstall it themselves. For households that bought an inexpensive Android TV box, the case is a reminder that such a device deserves the same scrutiny as a phone or a laptop.