Google shuts down a botnet of 1.3 million TV boxes infected at the factory

Google and its partners have taken down XCPE, a botnet of more than 1.3 million Android TV boxes, and banned the Chinese company that, according to Google, built it. The malware did not arrive through a bad app or a hack: it was written into the firmware at the factory. Google's Threat Intelligence Group (GTIG) says "with high confidence" that the backdoor was "intentionally developed, deployed, and operated for financial gain" by Videostrong Technology, a manufacturer that makes boxes for many brands. The report was published on 2 November.

The main components, x.cpe and com.oemservice, run with Android system privileges. Through them the operators could silently install apps, turn off Google Play Protect, run commands, take screenshots, simulate key presses and collect account and device data. If the malware is removed, it reinstalls itself from the device's /oem/ partition after a reboot, so a factory reset does not help. Google says the code was built into "many different device models and brands over multiple years" and calls it a deliberate business, not "an isolated rogue insider or a development oversight".

The security firm Synthient, one of the partners, bought a MECOOL KM9PRO Max box in late 2025 and found the malware already installed, BleepingComputer reports. On an open server used by the botnet it also found documents from Videostrong's R&D director, and the backdoors were signed with company email addresses. Most infected devices are TV boxes, but Google also found the backdoor in telehealth devices, karaoke machines and digital signage. The botnet is spread around the world. Google has not published a breakdown by country.

Read the full article on vpnlab.io: https://vpnlab.io/en/google-xcpe-botnet-videostrong-tv-boxes-2026-3197