Google Takes Down XCPE Botnet Infecting 1.3 Million Android TV Boxes Worldwide

More than 1.3 million Android devices, primarily Android TV boxes and streaming set-top boxes, have been compromised by a massive botnet operation involving malware embedded directly into device firmware. Google, along with several cybersecurity companies and law enforcement agencies, has now disrupted the infrastructure behind this operation in a coordinated takedown.

The botnet, identified as XCPE, used a hidden backdoor called x.cpe to gain remote access to infected devices. According to Google's Threat Intelligence Group, there is high confidence that Shenzhen-based device manufacturer Videostrong Technology Co. intentionally developed and deployed this backdoor to provide access to criminal groups for financial gain.

The compromised devices were reportedly used for advertising fraud, residential proxy services and distributing additional malware, all without the knowledge or permission of their owners.

What makes this incident particularly concerning is that the malware was not installed through a suspicious application downloaded by users. Instead, it was already embedded in the devices' firmware before they reached consumers.

Google Leads a Major Takedown of the XCPE Android Botnet

On November 2, 2026, Google announced that it had worked with several cybersecurity organizations and law enforcement agencies to disrupt the XCPE botnet.

The operation involved taking legal action to shut down the domains and servers used by Videostrong to control infected devices and distribute malicious software.

Google also disrupted the command-and-control (C2) infrastructure used by more than a dozen malware families that were delivered through the backdoor.

The investigation and takedown involved several organizations, including:

Google Threat Intelligence Group
Japan's National Police Agency
Lumen
HUMAN Security
Plume
Synthient
TrendAI (Trend Micro's enterprise security business)

Google estimates that disrupting the criminal infrastructure could also cut off access to at least 10 million additional compromised devices because the criminal groups involved distributed their malware through other channels as well.

However, cybersecurity researchers warn that criminals can quickly move to alternative infrastructure when their servers and domains are taken down.

How Many Android Devices Were Infected?

The scale of the XCPE botnet is significantly larger than an ordinary malware campaign.

According to research published by TrendAI, its telemetry identified 1,472,554 infected devices across 206 different device models between June 3 and October 1, 2026.

The infected devices were discovered in more than 170 countries.

Some of the countries with the highest numbers of reported infections included:

Malaysia
Brazil
Iraq
Mexico
Taiwan

The United States, Germany, the United Kingdom, Australia and Canada also reported approximately 26,000 to 42,000 infected devices each.

TrendAI also identified more than 3.8 million distinct residential exit IP addresses associated with the operation during its observation period.

Most infected devices were Android TV boxes and streaming set-top boxes. However, researchers also discovered the backdoor in other Android-powered products, including telehealth devices, karaoke machines and digital signage systems.

These findings demonstrate that the threat was not limited to one particular TV box model or brand.

What Is the x.cpe Backdoor and How Does It Work?

The x.cpe backdoor is malicious software embedded directly into the firmware of affected Android devices.

Unlike ordinary Android applications, which generally operate with restricted permissions, x.cpe runs with Android system-level privileges.

This gives its operators extensive control over the infected device.

According to Google's technical investigation, the malware operates as a remote management component that communicates with command-and-control servers and waits for instructions.

Once a device connects to the malicious infrastructure, attackers can remotely perform several operations.

Some of the capabilities identified by Google include:

Silent application installation: Download and install Android applications without the owner's knowledge.
Remote command execution: Execute commands and scripts with system-level privileges.
Screen monitoring: Capture screenshots of the device remotely.
Keystroke injection: Send simulated keyboard inputs to control the device.
Data collection: Access device information, application lists, system logs and account-related information.
Network reconnaissance: Examine the local network and gather information about connected infrastructure.
Additional malware installation: Download and execute other malicious applications and modules.

Google also discovered that the malware could disable Google Play Protect's application verification mechanism, making it easier for attackers to install malicious applications without normal security checks.

Researchers found evidence that Videostrong's operators had used these capabilities to capture live screenshots, send keystrokes, collect sensitive information and establish reverse shells on compromised devices.

A reverse shell provides attackers with a remote command-line connection, allowing them to execute commands on the infected device.

This is particularly concerning because an Android TV box connected to a home network could potentially become an entry point for further malicious activity.

How Criminals Used Infected Android TV Boxes to Make Money

The primary objective of the XCPE operation was financial gain.

Instead of simply infecting devices, the operators used a modular malware system to turn compromised Android hardware into infrastructure that could generate revenue.

Researchers identified several monetization methods.

1. Residential Proxy Networks

One of the most significant uses of the infected devices was residential proxy services.

A residential proxy allows someone to route their internet traffic through another person's home internet connection.

For example, a criminal operating from another country could route traffic through an infected Android TV box in India or the United States. Websites would then see the residential IP address of the victim instead of the actual source IP address.

Residential proxies can be abused for:

Credential stuffing attacks
Automated account creation
Scraping websites
Bypassing geographical restrictions
Hiding the origin of suspicious internet traffic
Fraudulent online activities

The device owner may not even notice that their internet connection is being used by someone else.

TrendAI reported that the botnet offered an average of approximately 182,000 residential IP addresses per day, with a peak of more than 366,000.

2. Online Advertising Fraud

Another major revenue source was advertising fraud.

The malware installed additional modules capable of generating fraudulent advertising impressions and simulating user interactions.

In simple terms, these infected devices could artificially load advertisements and generate fake views, allowing criminals to make money through advertising fraud.

Because the activity happened in the background, device owners generally had no reason to suspect that their TV boxes were participating in these operations.

3. Installing Additional Malware

The x.cpe backdoor also acted as a delivery mechanism for other malware families.

Criminal affiliates could use the compromised devices to install additional applications and malicious modules.

This modular approach allowed operators to change the functionality of infected devices without having to replace the original backdoor.

It also created an ecosystem in which access to compromised devices could be sold or distributed to multiple criminal groups.

Which Android TV Box Brands and Models Are Affected?

The investigation identified several device models associated with the XCPE botnet.

Synthient's research particularly focused on devices sold under the MECOOL brand and linked the affected devices to Videostrong Technology.

Researchers purchased a MECOOL KM9PRO Max Android TV box and discovered that it contained the x.cpe backdoor before any additional malicious software was installed.

The investigation also identified multiple other device models and brands associated with the campaign.

Synthient has published a list of 182 device model names observed during its investigation.

You can check the published research here:

View the list of 182 potentially affected Android device models on GitHub.

Important: Finding your device model on this list does not automatically confirm that your particular device is infected. The list identifies models observed in the campaign, and additional investigation is required to establish whether an individual device is compromised.

Can You Remove the x.cpe Malware by Performing a Factory Reset?

Unfortunately, removing this backdoor is not as simple as uninstalling an application or resetting an Android TV box.

The main reason is that x.cpe is embedded in the device's firmware and operates as a system application.

According to Google's investigation, the malware can reinstall itself after a reboot if someone attempts to uninstall it.

TrendAI also confirms that the backdoor is signed with the manufacturer's key and cannot be permanently removed by ordinary users.

This creates a serious security problem for device owners.

A factory reset may help remove some additional applications installed by the malware, but it should not be considered a reliable method of removing the firmware-level backdoor.

The researchers recommend vendor-level remediation, platform-level protection or replacing the affected device.

Synthient goes further and recommends permanently disposing of affected devices because of the risk of additional malware.

What Should Android TV Box Owners Do to Stay Safe?

If you own an Android TV box, particularly an inexpensive streaming device from an unknown manufacturer, this incident highlights why checking the security and reputation of the manufacturer is important.

Here are some practical steps you should consider.

1. Check Your Android TV Box Model

Start by identifying the manufacturer and exact model number of your Android TV box.

Compare it with the device names published in Synthient's research repository.

Remember that a matching model name is a warning to investigate further, not definitive proof of infection.

2. Disconnect Suspicious Devices From the Internet

If your device is identified as affected or you have strong reasons to suspect that it is compromised, disconnect it from your home network.

Unplug its Ethernet cable or disable its Wi-Fi connection.

This can prevent the device from communicating with its remote control servers, although it does not remove the malware from its firmware.

3. Avoid Installing Untrusted Applications

Avoid installing APK files from unknown websites or third-party sources.

Use trusted application stores and pay attention to application permissions.

Also, be cautious about applications that offer money in exchange for sharing your unused internet bandwidth.

4. Secure Your Home Wi-Fi Network

If you suspect that your Android TV box has been compromised, review your router's connected-device list.

Consider changing your Wi-Fi password and reconnecting only trusted devices.

You should also ensure that your router firmware is updated and that unknown devices cannot access sensitive computers or network storage.

5. Replace Devices That Cannot Be Secured

If the manufacturer does not provide a trusted firmware update or a verified method of removing the backdoor, replacing the device is the safest option.

A factory reset alone should not be treated as a permanent solution.

For organizations, researchers also recommend isolating IoT devices from business networks, blocking known malicious domains and IP addresses, and monitoring suspicious network traffic.

Why Google Banned Videostrong From the Android Ecosystem

One of the most significant consequences of this investigation is Google's decision to cut ties with Videostrong.

Google has banned Videostrong, including its future subsidiaries and affiliates, from:

Building and selling certified Android devices.
Supplying software to other certified Android device manufacturers.
Participating in Google's certified device ecosystem.

Google also acknowledged a gap in its device security testing process.

According to the company, Videostrong used obfuscation techniques to hide the malicious code during pre-release security checks and loaded the malware after the device's first boot.

This meant that the malicious software could avoid detection during parts of the certification process.

Google says it has updated its review process and is improving firmware integrity checks for certified Android TV devices to prevent similar incidents in the future.

However, this incident raises important questions about how manufacturers and certification programs verify the security of Android devices before they reach consumers.

How Was Videostrong Linked to the XCPE Botnet?

Google's investigation and independent research by Synthient identified several connections between Videostrong and the malicious infrastructure.

Some of the findings included:

The x.cpe backdoor was built into firmware used across multiple device models and brands.
Google's investigation identified connections between the backdoor and Videostrong applications, including its YokaTV Player.
One GitHub account hosting the botnet's software packages used the name yf-videostrong.
Synthient discovered a document signed by Videostrong's research and development director in a publicly accessible directory on one of the botnet's servers.
Researchers also identified network infrastructure connections between Videostrong's web domain and the operators' control panel.

Based on these findings, Google expressed high confidence that Videostrong intentionally developed and operated the backdoor for financial gain.

The company also stated that the campaign was not simply the result of an isolated rogue employee or an accidental software development mistake.

XCPE and BadBox 2.0: A Growing Security Problem for Android Devices

The XCPE incident also highlights a broader security problem involving inexpensive Android-based devices.

In July 2025, Google filed a lawsuit against entities connected to the BadBox 2.0 botnet, which involved more than 10 million uncertified Android devices.

Both incidents demonstrate how compromised Android hardware can become part of large criminal networks without users being aware of it.

The problem is particularly serious for inexpensive streaming boxes and smart devices that receive limited firmware updates or come from manufacturers with weak security practices.

Consumers often focus on hardware specifications, streaming performance and price when purchasing an Android TV box. However, the security of the firmware and the manufacturer's update policy are equally important.

A device that appears to work normally can still be communicating with malicious servers in the background.

Final Thoughts

The disruption of the XCPE botnet is a significant development in the fight against malware embedded in consumer electronics.

More than 1.3 million Android devices were reportedly affected, and the operation demonstrates how ordinary household devices can be turned into tools for advertising fraud, residential proxy networks and other cybercriminal activities.

Although Google and its partners have disrupted the infrastructure controlling the botnet, the discovery of a persistent firmware-level backdoor raises serious concerns for owners of affected devices.

The biggest lesson from this incident is that buying an Android TV box from an unknown manufacturer can carry security risks that go far beyond poor performance or missing software updates.

Consumers should pay attention to device manufacturers, firmware security and update policies before purchasing connected devices.

For affected devices that cannot receive a trusted security fix, replacing the hardware is a safer choice than relying on a factory reset.