Google has cut off an Android TV box botnet called XCPE that ran on more than 1.3 million streaming boxes. Its researchers say the company that made the boxes, Shenzhen-based Videostrong Technology, planted the backdoor on purpose.

The Google Threat Intelligence Group wrote that it has “high confidence” Videostrong ran the botnet “for financial gain.” Google has banned the company from making certified Android devices.

The detail that matters most for owners is that some of these boxes passed Google’s own certification. That breaks the usual advice for spotting a risky box. The checks below go further than “make sure it’s certified”.

4 Signs Telling That Parasites Are Living Inside Your Body

4 signs telling that parasites are living inside your body...

November 3, 2026

2:44 am

I did this and my knees and joints haven’t hurt for 10 years now.

i did this and my knees and joints haven’t hurt for 10 years now....

November 3, 2026

2:56 am

After Reading This, You Will Be Rich in 7 Days. Simple trick

after reading this, you will be rich in 7 days. simple trick...

November 3, 2026

3:00 am

Hair Grows Back in 2 Weeks! at Any Stage of Baldness

hair grows back in 2 weeks! at any stage of baldness...

November 3, 2026

2:42 am

A backdoor installed at the factory

The malware was not something owners downloaded. The maker built it into the firmware at the factory, according to Google and BleepingComputer’s Lawrence Abrams, who covered the takedown on November 2.

The main component, called x.cpe and sometimes com.oemservice, runs with Android system-level privileges. If a user uninstalls it, Google says, “it automatically reinstalls from the /oem/ partition upon reboot.”

From there the operators could install apps silently, run commands and capture the screen. They could also switch off Google Play Protect, Android’s built-in malware scanner. Google’s report includes the code that disables those app checks.

Read This Immediately if You Have Moles or Skin Tags, It's Genius

read this immediately if you have moles or skin tags, it's genius...

November 3, 2026

2:57 am

Varicose Veins and Blood Clots Will Disappear Very Quickly ! at Home!

varicose veins and blood clots will disappear very quickly ! at home!...

November 3, 2026

2:38 am

Do This Every Night and the Fungus Will Disappear in 5 Days

do this every night and the fungus will disappear in 5 days...

November 3, 2026

3:01 am

Lose 40 lbs by Consuming Before Bed for a Week

lose 40 lbs by consuming before bed for a week...

November 3, 2026

2:45 am

Google says Videostrong sold access to criminal “affiliates”, who loaded their own modules onto the boxes. The modules did three jobs:

• Turned the box into a residential proxy, so strangers’ internet traffic ran through the owner’s home connection. Google names Linkfog, AppSalt/Honeygain, NetNut and Traffmonetizer among the proxy tools.
• Ran ad fraud through engines Google calls HiddenView and Fission.
• Installed more backdoors, which Google calls Spirit, Moyu and Bird.

That’s why a box can look fine on the TV while it works for someone else. Buyers’ home connections could carry that traffic without their knowledge, The Register notes.

Google worked with Japan’s National Police Agency to take down the botnet’s control servers. Security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI also took part.

55-year-old woman with baby face. Here's her secret!

55-year-old woman with baby face. here's her secret!...

November 3, 2026

2:43 am

4 Signs Telling That Parasites Are Living Inside Your Body

4 signs telling that parasites are living inside your body...

November 3, 2026

2:40 am

Healthy joints in 7 days! No doctors or surgery!

healthy joints in 7 days! no doctors or surgery!...

November 3, 2026

2:59 am

Seer Teresa: if You Carry Them in Your Pocket, You Will Have a Lot of Money

seer teresa: if you carry them in your pocket, you will have a lot of money...

November 3, 2026

2:43 am

The same affiliates spread their modules through other channels too. So Google expects the action to “sever access to at least 10 million additional compromised devices.” Most are TV boxes, but Google also found infected telehealth devices, karaoke machines and digital signs.

Tens of thousands of the boxes were in the US

Google’s report doesn’t list countries. It describes the botnet only as “globally dispersed.”

Other outlets got the numbers from TrendAI. CyberScoop’s Matt Kapko reported that nearly 44,000 infected devices were in the US between June and October.

Hair grows 2 cm per day! Just do this

hair grows 2 cm per day! just do this...

November 3, 2026

2:40 am

If You Find Moles or Skin Tags on Your Body, Read About This Remedy. Genius!

if you find moles or skin tags on your body, read about this remedy. genius!...

November 3, 2026

2:42 am

America is in Shock! It Helps to Get Rid of Varicose Veins. Do It at Night

america is in shock! it helps to get rid of varicose veins. do it at night...

November 3, 2026

2:37 am

Do This Every Night and the Fungus Will Disappear in 5 Days

do this every night and the fungus will disappear in 5 days...

November 3, 2026

3:02 am

The botnet reached more than 170 countries. The biggest clusters were in Malaysia, Brazil, Iraq, Mexico and Taiwan.

The Hacker News put TrendAI’s total at 1,472,554 infected devices across 206 models from June 3 to October 1. By our math, CyberScoop’s US div is about 3% of that total. The US is a minor market for this botnet, but that still means tens of thousands of American homes.

Only one consumer brand appears on the record so far. Synthient found the backdoor preinstalled on a MECOOL KM9PRO Max it bought in late 2025, according to BleepingComputer.

Lose 40 lbs by Consuming Before Bed for a Week

lose 40 lbs by consuming before bed for a week...

November 3, 2026

2:49 am

A young face overnight. You have to try this!

a young face overnight. you have to try this!...

November 3, 2026

2:39 am

This Simple Trick Removes All Parasites From Your Body!

this simple trick removes all parasites from your body!...

November 3, 2026

2:35 am

People From US Those With Knee And Hip Pain Should Read This!

people from us those with knee and hip pain should read this!...

November 3, 2026

2:39 am

Plume found more than a dozen devices talking to the botnet’s control server, most of them MECOOL boxes, The Hacker News reports. Synthient has also published a list of 182 model names seen in the campaign.

Google says the backdoor appeared in “many different device models and brands over multiple years.” So a box without a MECOOL logo isn’t automatically in the clear. Videostrong also supplied the firmware and remote-management tools for other companies’ devices, The Hacker News reported.

Why the ‘certified’ label didn’t stop it

The usual advice for Android TV boxes is simple: buy one that Google has certified. The FBI’s June 2025 warning about an earlier botnet, BADBOX 2.0, made the same point. It lists uncertified Android devices as a warning sign.

Carry this with you and luck will find you.

carry this with you and luck will find you....

November 3, 2026

2:55 am

Hair Will Grow Back! No Matter How Severe the Baldness

hair will grow back! no matter how severe the baldness...

November 3, 2026

2:47 am

If You Find Moles or Skin Tags on Your Body, Read About This Remedy

if you find moles or skin tags on your body, read about this remedy...

November 3, 2026

2:43 am

Varicose Veins Will Disappear in the Morning! Read!

varicose veins will disappear in the morning! read!...

November 3, 2026

2:40 am

XCPE broke that rule of thumb. Videostrong was a certified partner.

As of November 2, its website still listed a “Google Certified Android TV Box,” The Hacker News reported. The botnet included both certified boxes and ones running uncertified open-source Android.

Google says the company used obfuscation “to exploit a gap in our tests and load malicious code after the device’s first boot.” In other words, the box looked clean during Google’s testing and changed afterward.

The Fungus Will Disappear In 1 Day! Write Down An Expert's Recipe

the fungus will disappear in 1 day! write down an expert's recipe...

November 3, 2026

2:36 am

My weight was 198 lbs, and now it’s 128 lbs! My diet is simple. 1/2 Cup Of This (Before Bed)

my weight was 198 lbs, and now it’s 128 lbs! my diet is simple. 1/2 cup of this (before bed)...

November 3, 2026

3:01 am

A young face overnight. You have to try this!

a young face overnight. you have to try this!...

November 3, 2026

2:58 am

This Simple Trick Removes All Parasites From Your Body!

this simple trick removes all parasites from your body!...

November 3, 2026

2:45 am

“The XCPE operators constantly evolved its configurations to evade Google’s pre and post-launch detections,” Charley Snyder told CyberScoop. He heads disruption operations at Google’s threat group.

Google says it has changed its review process and tightened firmware checks for certified Android TV devices. It hasn’t said how.

Certification is still worth checking, since Google and the FBI both treat an uncertified box as a red flag. It just isn’t proof on its own.

Knee & Joint Pain Will Go Away if You Do This Every Morning!

knee & joint pain will go away if you do this every morning!...

November 3, 2026

2:44 am

After Reading This, You Will Be Rich in 7 Days

after reading this, you will be rich in 7 days...

November 3, 2026

2:55 am

Hair Will Grow Back! No Matter How Severe the Baldness

hair will grow back! no matter how severe the baldness...

November 3, 2026

2:38 am

If You Find Moles or Skin Tags on Your Body, Read About This Remedy

if you find moles or skin tags on your body, read about this remedy...

November 3, 2026

2:59 am

How to check the box under your TV

Start with the label. Google’s Play Protect certification help page gives the steps. Open the Google Play Store app, select your profile icon, then go to Settings and About.

That shows whether the device is Play Protect certified. Menus on TV boxes vary, so look for the same Play Store settings if the layout differs.

If it says the device isn’t certified, take that seriously. Google’s page says such devices “may not be secure.” It adds that Google apps on them “aren’t real Google apps.”

America is in Shock! It Helps to Get Rid of Varicose Veins. Do It at Night

america is in shock! it helps to get rid of varicose veins. do it at night...

November 3, 2026

2:50 am

Do This Every Night and the Fungus Will Disappear in 5 Days

do this every night and the fungus will disappear in 5 days...

November 3, 2026

2:53 am

I weighed 332 lbs, and now 109! My diet is very simple trick. 1/2 Cup Of This (Before Bed)

i weighed 332 lbs, and now 109! my diet is very simple trick. 1/2 cup of this (before bed)...

November 3, 2026

2:55 am

Do this twice a day, and everyone will think you have Botox!

do this twice a day, and everyone will think you have botox!...

November 3, 2026

2:50 am

Next, find the brand and model name, which is usually on the box itself or in the Settings menu. Compare it with MECOOL and with Google’s list of certified Android partners, which doesn’t include Videostrong or MECOOL.

Then go through the FBI’s other warning signs. They include a box that asks you to turn off Play Protect, or one sold as “unlocked” for free content. Apps from unofficial marketplaces, an unfamiliar brand and unexplained internet traffic are on the list too. The FBI says one sign alone doesn’t prove anything.

Finally, check for apps that pay you to share your connection. Google warns consumers to be “extremely wary” of anything offering money for “unused bandwidth” or “sharing your internet.” Google also says most devices become proxies silently, with no consent asked, so a clean app list proves little.

Doctor: A Teaspoon Kills All Parasites In Your Body!

doctor: a teaspoon kills all parasites in your body!...

November 3, 2026

2:45 am

Get rid of joint pain in minutes! This will help you...

get rid of joint pain in minutes! this will help you......

November 3, 2026

2:39 am

After Reading This, You Will Be Rich in 7 Days

after reading this, you will be rich in 7 days...

November 3, 2026

2:48 am

Hair Will Grow Back! No Matter How Severe the Baldness

hair will grow back! no matter how severe the baldness...

November 3, 2026

3:00 am

What to do if your box looks suspect

A factory reset won’t reliably fix this. Google and BleepingComputer both say the backdoor lives in a protected part of the firmware and returns on reboot.

Plume still recommends a full reset, because the add-on modules may have installed other backdoors. It doesn’t say a reset removes x.cpe itself.

The options BleepingComputer lists are installing clean firmware or disconnecting the box from the internet. Synthient goes further and tells consumers to throw the boxes away, The Hacker News reported.

For most people, the practical answer is to unplug the box and take it off your Wi-Fi. Replace it with a streaming device from a major brand that still gets updates. Our guide to the Broadcom Wi-Fi flaw in home routers covers other router settings worth checking.

The FBI asks anyone who thinks a device has compromised their network to report it at ic3.gov. For how to tell real threats from hype, see our explainer on the “Black October” hacks.

Videostrong did not immediately respond to questions from The Register’s Jessica Lyons. With the control servers down, the next test is whether the operators rebuild. They have adapted before. Since August 2026, Google says, they have pushed new droppers disguised as Android system apps.