XCPE botnet: Google disrupts infected Android TV boxes

Google and its partners have disrupted the XCPE botnet, which infected more than 1.3 million Android TV streaming boxes. In its November 2 announcement, Google accused Chinese manufacturer Videostrong Technology Co. of deliberately installing malware during production and selling access to criminal affiliates.

Google bans manufacturer following investigation

Google said it attributed the operation to Videostrong with high confidence. According to its investigators, the manufacturer developed and distributed the backdoor across multiple brands and models over several years. Affiliates then used the compromised devices for advertising fraud, residential proxy traffic and additional malware installations.

Consequently, Google ended its relationship with Videostrong and revoked its licence to manufacture Android TV devices with preloaded Google applications and services. The ban also prevents the company and its future affiliates from producing certified Android devices. Furthermore, they cannot supply software to certified vendors.

The disruption involved Japan’s National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. Together, they analysed the infrastructure and interrupted its operations. Google said the server takedowns also cut off criminal access to at least 10 million additional compromised devices linked to more than a dozen related malware families.

However, those additional devices did not acquire their infections through XCPE. They included set-top boxes, karaoke machines and telehealth equipment, and some did not run Android.

Factory-installed malware enabled remote control

Unlike malware that relies on users downloading an infected application, the XCPE botnet relied on backdoors embedded in device firmware. Its main components, tracked as x.cpe and com.oemservice, operated with Android system privileges. After startup, the malware contacted its control infrastructure to obtain connection details and receive commands.

Operators could silently install applications, disable Google Play Protect and execute commands with elevated privileges. They could also capture screenshots, inject keystrokes and collect account information or system logs. In addition, the backdoor supported network reconnaissance and further remote access.

Meanwhile, separate modules generated revenue through hidden advertisements and unauthorised proxy services. These services routed third-party internet traffic through victims’ devices without their knowledge. Other modules installed additional backdoors, expanding the attackers’ access.

Google said the operators repeatedly changed the malware to avoid detection. They introduced a separate loader in late 2024, then began replacing it with smaller droppers in August 2026. Those newer components disguised themselves as Android system applications.

Researchers trace links to Videostrong

Synthient investigated after finding preinstalled malware on a MECOOL KM9PRO Max TV box purchased in late 2025. Researchers discovered a publicly accessible server directory containing backdoors and a document associated with Videostrong’s research and development director. They also identified shared infrastructure and company email addresses used to sign malicious components.

Google said the evidence pointed to deliberate manufacturer involvement, rather than an isolated employee or development mistake. As a result, it has changed its certification review process. Investigators said Videostrong had concealed malicious code and loaded it after devices first started.

Disruption leaves infections on affected devices

Although the takedown interrupted the XCPE botnet, it did not remove the malware from infected hardware. The backdoor can reinstall itself from the device’s /oem/ partition after removal. Therefore, affected users need clean firmware to eliminate the infection or must disconnect the device from the internet to prevent further malicious activity.