Home · Technology · Nov 2 archive
Google Shuts Down Malware on Millions of Android TV Devices
· Confirmed
In Short: Google has dismantled a botnet that infected over 1.3 million Android TV set-top boxes, with some estimates suggesting up to 10 million more devices were compromised.
Google has taken action against a botnet that infected over 1.3 million Android TV set-top boxes, with some estimates suggesting up to 10 million more devices were compromised. The malware, known as XCPE, was pre-installed on devices manufactured by Videostrong, a company based in Shenzhen, China.
The malware, which was embedded in the firmware of the devices, allowed attackers to remotely control the infected devices, install additional apps, and collect sensitive information. It also disabled Google Play Protect, the built-in security feature that checks apps for malware.
According to Google, the malware was intentionally deployed by Videostrong to profit from ad fraud, data exfiltration, and residential proxy services. The company hid its malicious code to pass certification tests, loading it only after the first start-up of the device.
Google has since taken legal action against Videostrong, banning the company and its subsidiaries from selling certified Android devices or supplying software to any other certified vendors. The company has also shut down the domains and servers used to control the XCPE botnet.
The botnet spanned more than 170 countries, with the largest concentration of infected devices in Malaysia, Brazil, Iraq, Mexico, and Taiwan, according to TrendAI researchers. Google estimates that the overwhelming majority of the infected devices are Android TV set-top boxes.
Google's report highlights that the malware was pre-installed on devices like the MECOOL KM9PRO Max, which was purchased in late 2025. The malware maintained a standing connection to a control server and could install additional apps, run commands, take screenshots, and collect account details.
Synthient, one of Google's partners, estimated that about 500,000 compromised devices were online at the time, mostly in Malaysia, Mexico, and Brazil. The malware was capable of downloading files on command, further spreading the infection.
Google has taken steps to protect users by cutting ties with Videostrong and issuing guidelines for affected users. However, the malware remains on the devices, and owners cannot remove it themselves. Users are advised to check if their device is listed as affected and take appropriate action.
Google's actions have led to security improvements for the Android TV ecosystem as a whole. The company acknowledges that this was a failing on its part, as these devices were sold as 'certified' Android devices with the implication that they were safe.
Google and its partners have dismantled the XCPE botnet, which was used for financial gain by Videostrong. The company monetized the backdoor by selling access to criminal affiliates and loading their malware modules onto infected devices.
In a statement, Google said, 'A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust.' The company has also warned that the underlying market for backdoors, ad fraud, and residential proxy networks remains resilient and operates as an interconnected supply chain.
What this adds
The exact number of infected devices varies between sources, with estimates ranging from 1.3 million to over 10 million. The malware was pre-installed on devices, making it different from typical attacks where users download shady apps from the internet.
Google's actions against Videostrong include legal action and the banning of the company from making more Android TV boxes with pre-loaded Google apps and services. The company has also shut down the domains and servers used to control the XCPE botnet.
Users are advised to check if their device is listed as affected and take appropriate action, as the malware remains on the devices and cannot be removed by users themselves.
What's confirmed
- "a device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust."
- Google has taken legal action to block the domains and servers that “Videostrong” was using to control the XCPE botnet and malware modules and banned the company and its subsidiaries from selling certified Android devices going forward, or selling software to any other certified vendors.
- According to Google, these modules were committing ad-fraud and enrolling infected devices into “residential proxy networks,” while also loading additional malware onto compromised devices.
- "vendor action, platform protection or replacement of the device."
- Google said on November 2 that TV box maker Videostrong intentionally built a backdoor into more than 1.3 million Android set-top boxes.
What's still developing
- What’s more, Google says that by knowingly infecting devices that customers would then purchase, it was intentionally opening them up to a wide variety of malicious activity that included potential data-exfiltration and routing malicious network traffic through the devices.
- While the existence of this activity on devices that millions of people have purchased is a huge breach of trust, Google says, the company confirms that there is a positive result from discovering this series of actions.
- Google has reportedly shut down operations and cut ties with one of its Google TV /Android TV partners over inserting a backdoor that opened the path for potential botnet activity, and has since offered up an official blog post about the goings on and Google’s steps moving forward.
- The backdoor, called x.cpe, was built into many device models and brands over several years.
- Plume found that Videostrong supplies both the firmware for these devices and tools to manage them remotely.
- Unlike the usual attacks, where users end up downloading some shady apps from the internet, the malware here was planted inside the devices by the manufacturer itself.
- Google pursued legal action against infrastructure controlling both XCPE and more than a dozen malware families distributed through it.
- [1] [2] If you own a cheap streaming box, especially one sold under the MECOOL name, the takedown does not clean your device, so you still have some work to do.
- Start by finding the brand and model printed on the underside of your box, and look it up against the list of affected devices that Synthient published, which focuses on MECOOL. [3] Then work through these steps.
- A pair of Gemini app updates today brings the latest design to all Android devices, while file generation sees a big upgrade.
- This updated design was first introduced on phones with Gemini Intelligence (Pixel 11) and is now available on all other devices we checked today.
- All that said, the use case is fundamentally different.