XCPE Botnet Infects Over 1.3 Million Android TV Boxes
More than 1,3 million Android TV boxes across over 200 countries were infected with the XCPE botnet before Google and international partners dismantled its command-and-control infrastructure on November 2, 2026, according to vtm.zive.cz. The malicious backdoor was hard-coded directly into the firmware system partition during manufacturing rather than downloaded later by users.
Google attributed the commercial distribution of the malware directly to Videostrong Technology. The manufacturer bypassed security and compatibility testing by programming the backdoor to load only after the device booted up for the first time. Once running, the backdoor established persistent communication via the MQTT protocol to receive operator instructions.
Videostrong Technology Monetized Compromised Devices
Videostrong monetized the infected hardware by selling remote access to other criminal syndicates. Attackers used the compromised TV boxes to run ad fraud campaigns, install secondary malware payloads, and route traffic through residential proxy networks. These proxies masked malicious web traffic so it appeared to originate from legitimate residential internet subscribers.
Because the malware operated with system-level privileges, operators possessed nearly unrestricted control over the hardware. Investigations by Google revealed that the botnet software could capture screenshots, simulate remote control button presses, execute system commands, and harvest user credentials, application lists, and system logs. The malware also disabled Google Play Protect security features to silently install unauthorized software.
Synthient Analysts Discovered Backdoor in Test Hardware
Security researchers at Synthient identified the same backdoor inside a MECOOL KM9PRO Max test box. The malicious code also appeared in alternative hardware categories, including karaoke machines, digital display panels, and medical equipment.
Google severed all business ties with Videostrong Technology, banning the firm and its associated subsidiary entities from manufacturing certified Android devices or supplying software to other hardware vendors. Google also updated its security verification procedures to enforce stricter firmware integrity checks for Android TV devices. While Google shut down server domains controlling numerous other devices infected by separate malware variants, those actions do not cleanse existing hardware infections.
Why Infected TV Boxes Must Be Replaced
Factory resets and manual file deletions fail to remove the XCPE backdoor because the malicious code reinstalls itself from the `/oem/` system directory upon every device reboot. Fixing an infected unit requires a clean, verified firmware flash supplied by the manufacturer. Because Videostrong Technology has not released clean firmware patches for the compromised hardware, the only safe solution is to immediately disconnect and discard affected TV boxes.
Earlier coverage: Google dismantles XCPE botnet of 1.3 million Android TV boxes
More on Videostrong Technology
Worth a look