Google dismantles XCPE botnet of 1.3 million Android TV boxes

Google has dismantled the XCPE botnet, an operation that preinstalled a malicious backdoor on more than 1.3 million Android TV boxes. Working alongside the Japanese National Police Agency, Synthient, Trend Micro, and other security partners, Google cut ties with the device manufacturer, Videostrong Technology, and initiated legal actions to seize the domains and servers used to manage the infected hardware.

The Scope of the XCPE Infection

The botnet, which primarily targeted low-cost Android TV boxes, was used for ad fraud, data theft, and routing malicious traffic through unsuspecting users’ internet connections. According to a report by The Register, the Google Threat Intelligence Group (GTIG) confirmed that the backdoor was intentionally embedded in the device firmware by the Shenzhen-based manufacturer.

While Google estimates that approximately 10 million compromised devices were connected to the broader infrastructure managed by Videostrong, Trend Micro documented a more specific count of 1,472,554 infected devices. These units were distributed globally, with the highest concentrations in Brazil, Malaysia, Iraq, Mexico, and Taiwan. Tens of thousands of infected boxes were also identified in Australia, Canada, Germany, the UK, and the United States. Between June 3 and October 1, 2025, TrendAI recorded more than 3.8 million distinct IP addresses interacting with the botnet, Ars Technica reported.

Challenges for Affected Device Owners

Although the disruption prevents the botnet from effectively controlling the devices, the malware remains on the hardware. Because the malicious modules were installed as system-level applications, users cannot easily remove them. Google’s Play Protect is disabled on these specific units, leaving them in a compromised state.

Synthient has released a list of 182 device models known to be part of the XCPE botnet. Owners of MECOOL or unbranded Android TV boxes are encouraged to verify their hardware against this list. The Register noted that this campaign is linked to the same ecosystem as the "BadBox 2.0" botnet, which previously infected 10 million devices before being disrupted in March 2025.

Google Updates Certification Process to Block Videostrong

Google has responded by updating its Android certification process to close the loophole that allowed Videostrong to bypass security checks. Moving forward, Videostrong and its subsidiaries are prohibited from using Google’s Android apps and services.

Despite these measures, the open-source nature of Android means that uncertified TV boxes continue to circulate. While Videostrong would need to rebuild its malware operation from the ground up to target new devices, the existence of countless uncertified manufacturers remains a significant security concern. Videostrong did not respond to requests for comment regarding the allegations.

Verify Device Infection Against Published Model Lists

How can I check if my device is infected?
You should compare your device’s model name against the list of 182 affected units published by Synthient. If you own a MECOOL or generic Android TV box, verifying the model number is the most reliable way to determine if it was part of the XCPE botnet.

Can I delete the malware from my TV box?
No. Because the malware is baked into the firmware as a system app, standard uninstallation methods will not work. While the disruption of the command-and-control servers has neutralized the botnet’s ability to issue new commands, the malicious code remains present on the hardware.

Are all Android TV boxes at risk?
Only specific devices manufactured by Videostrong were identified as carrying the XCPE backdoor. Google recommends that consumers purchase set-top boxes exclusively from reputable manufacturers listed as official Android TV partners to ensure devices have passed the company’s current security certification standards.

More on Google: Google Bans Videostrong After Discovering Backdoor in 1.3M Android Devices · Google Play System Update Brings New Features to Android Devices · Google Unveils Gemini 4 Carbon Model for Cybersecurity and Coding