Google Bans Videostrong After Its Backdoor Turned 1.3 Million Android TV Boxes Into the XCPE Botnet

Google has disrupted the XCPE botnet, a network of more than 1.3 million Android TV streaming boxes, and banned Chinese manufacturer Videostrong Technology Co. from producing certified Android devices, according to a report published Monday by the Google Threat Intelligence Group (GTIG). Google says Videostrong deliberately built the backdoor into devices it manufactured and sold access to criminal affiliates.

“We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.,” GTIG said.

Google also took down command-and-control servers used by more than a dozen related malware families, cutting off access to at least 10 million additional compromised devices. Those include retail set-top boxes, karaoke machines, and telehealth hardware, and Google says not all of them run Android.

Google Revokes Videostrong’s Android TV License

Google has ended its relationship with Videostrong and revoked the company’s license to manufacture Android TV devices with preloaded Google apps and services.

The ban extends to future affiliates, which cannot produce certified Android devices or supply software to certified vendors. Google says it changed its certification review process after finding that Videostrong used obfuscation to evade security testing and load malicious code only after a device first booted.

Japan’s National Police Agency joined the operation alongside security companies Lumen, HUMAN Security, Plume, Synthient, and TrendAI. Synthient traced the backdoor to Videostrong after finding it preinstalled on a MECOOL KM9PRO Max Android TV box bought in late 2025, and the researchers found Videostrong company email addresses had been used to sign the backdoors.

XCPE did not arrive through a vulnerability or a malicious download. The malware, tracked as x.cpe and com.oemservice, sat in the firmware from the factory and ran with Android system-level privileges. Operators could use it to:

• silently download and install additional Android apps
• disable Google Play Protect
• run shell commands and scripts with system privileges
• capture screenshots and inject keystrokes
• collect account information, device details, installed app lists, and system logs

Affiliates used the boxes for ad fraud, ran residential proxy software that routed third-party traffic through owners’ connections without consent, and installed further backdoors named Moyu, Spirit, and Bird.

What Owners of Infected Android TV Boxes Can Do

The takedown disrupted XCPE’s operations but did not remove the malware from infected boxes, Google says. The backdoor reinstalls itself from the /oem/ partition when it is deleted, so removing the malicious apps alone does not clean a device. Owners of affected boxes have two options:

1. Install clean firmware on the box to remove the infection.
2. Disconnect the box from the internet to stop further malicious activity if clean firmware is not available.

Google says Videostrong placed the malware in different device brands and models over multiple years, but the company has not published a full list of affected products beyond the MECOOL box identified by Synthient.

Thank you for being a Ghacks reader. The post Google Bans Videostrong After Its Backdoor Turned 1.3 Million Android TV Boxes Into the XCPE Botnet appeared first on gHacks.