Google says it has dismantled a botnet of more than 1.3 million Android TV set-top boxes, and that the company behind it was the manufacturer of the boxes. In a report published on Monday, 2 November, the Google Threat Intelligence Group said it assesses "with high confidence" that the XCPE backdoor and botnet were "intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.", an Android device maker and contract manufacturer.
Google has cut ties with Videostrong and banned it, along with any future subsidiaries or affiliates, from building or selling certified Android devices, from making devices with Google's apps preloaded, and from supplying software to certified vendors. "We believe this campaign wasn't an isolated rogue insider or a development oversight," Google wrote.
A backdoor built in at the factory
Unlike most botnets, XCPE did not rely on users installing a bad app or on a security hole. It was placed in the boxes' firmware during manufacturing and runs with Android's system-level privileges, according to Google and BleepingComputer. If a user removes it, it reinstalls itself from the device's /oem/ partition at the next reboot. Google says the malware switched off Google Play Protect so apps could be installed silently, and could run remote commands, take screenshots, inject keystrokes and send account and device data out.
Videostrong then sold access to the boxes to criminal affiliates, Google says. They loaded modules that ran ad fraud and turned owners' home internet connections into residential proxies that others pay to route traffic through, as well as further backdoors. Google also says Videostrong used obfuscation to get past its certification tests and load the malicious code after a device's first boot.
Most infected devices were Android TV boxes, but Google lists other Android hardware too, including telehealth devices, karaoke machines and digital signage. The security firm Synthient found XCPE preinstalled on a MECOOL KM9PRO Max box it bought in late 2025, BleepingComputer reports. Google describes the botnet as spread around the world and did not give a breakdown by country.
Related · AI and Tech StakGoogle Opens Free AI Skills Hub for 3 Million AfricansSkilling Africa with Google puts more than 15 Google courses in one free, offline-friendly hub, aiming at 3 million learners by 2030.The takedown
Google says it took legal action to take down the domains and servers Videostrong used to control the botnet, and the control domains of more than a dozen malware families loaded through it. That, it says, will also cut off access to at least 10 million more compromised devices, most of them infected by other malware. Japan's National Police Agency and the security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI worked on the disruption. Google has also changed how it reviews device makers and tightened firmware checks on certified Android TV devices.
Cutting the control servers stops the boxes taking orders, but it does not clean them. BleepingComputer notes that the malware remains on infected devices, and owners need clean firmware, or to keep the box offline, to stop it.
