Home · Technology · Nov 3 archive
Google Shuts Down Malware on 1.3 Million Android TV Devices
· Confirmed
In Short: The company severed ties with Videostrong and banned the company from its certified program after confirming it embedded malware into Android TV and Google TV devices sold over several years.
Google and an assortment of partners shut down a botnet affecting more than 1.3 million Android TV set-top boxes, according to a statement from the Google Threat Intelligence Group.
The botnet, called XCPE, was pre-installed in the firmware of these devices, allowing attackers to gain access before the products reached consumers.
Synthient, which tracks proxy networks and botnets, has published a list of 182 device model names seen in the campaign.
The compromised devices were primarily Android TV set-top boxes, although researchers also identified infections in karaoke machines, digital signage equipment, and telehealth devices.
The main component of the botnet goes by x.cpe or com.oemservice and runs with Android system privileges, which is the highest everyday level on the device.
It could also switch off Google Play Protect, the built-in app checker.
Synthient estimated that about 500,000 compromised devices were online at the time, mostly in Malaysia, Mexico, and Brazil.
Google said Shenzhen-based manufacturer Videostrong Technology deliberately embedded a malicious backdoor into Android devices during manufacturing.
Because these affiliates each have diversified distribution channels for their modules beyond XCPE, Google assessed that taking down their C2 domains will sever access to at least 10 million additional compromised devices.
The botnet relied on a backdoor built directly into the device’s firmware, and the money came from modules supplied by paying affiliates.
The secondary modules were conducting ad-fraud, silently enrolling infected devices into residential proxy networks, and loading additional malware onto XCPE-compromised devices.
Google announced at the Android Dev Summit 2026 that Googlebook detachables will be the next form factor after clamshells and convertibles.
Background
Google has confirmed that an Android TV device maker snuck a backdoor for malware onto certified devices, leading to security improvements for the ecosystem as a whole.
Google has shut down a malware backdoor on more than 1.3 million Android TV devices, primarily set-top boxes.
What's confirmed
- Its trail began with a MECOOL KM9PRO Max box bought in late 2025 that already carried the malware when it arrived. [1] [4] The main component goes by x.cpe or com.oemservice and runs with Android system privileges, which is the highest everyday level on the device. [1] [4] It keeps a standing connection to a control server and can quietly install apps, run commands, take screenshots, type keystrokes and collect account details, app lists and logs. [1] [4] It can also switch off Google Play Protect, the built-in app checker. [1] [2] The money came from modules supplied by paying affiliates.
- [1] [3] Synthient, one of the partners, estimated that about 500,000 compromised devices were online at the time, mostly in Malaysia, Mexico and Brazil.
- Writing in the Google Cloud blog, the Google Threat Intelligence Group said it assessed with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co., an Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM).
- The compromised devices were primarily Android TV set-top boxes, although researchers also identified infections in karaoke machines, digital signage equipment and telehealth devices.
- These secondary modules were conducting ad-fraud; silently enrolling infected devices into residential proxy networks; and loading additional malware onto XCPE-compromised devices.
What's still developing
- Meta has been developing wearable computers for a while now, including VR and lighter XR headsets, often citing that they’re devices for the post-smartphone era.
- That means it’s sure to tie in with your Android-powered smartphone better than anything else on the market, something we’ve seen from Wear OS smartwatches.
- Samsung Intelligent Eyewear also has the advantage of having Gemini onboard and running Android XR, the official Google-built operating system for smart glasses and VR headsets.
- A few tweaks made long road trips less chaotic Nothing annoyed me more than Android Auto disconnecting in the middle of a drive.
- Parth is a technology analyst and writer specializing in the comprehensive review and feature exploration of the Android ecosystem.
- His work focus on productivity apps and flagship devices, particularly Google Pixel and Samsung mobile hardware and software.
- "Create a grocery list in Google Tasks for my weekend run."
- Google says an update is rolling out to fix Android Auto connection problems affecting Samsung Galaxy phones that have installed the One UI 9 update.
- What was the primary connection method Android Auto required when it first launched?
- Several users have reported that Android Auto is no longer connecting properly after installing the Android 17-based update.
- Over the past several months, countless users have reported experiencing wired and wireless Android Auto disconnects, especially with Samsung and Pixel devices.
- Start powering your devices with it now by picking it up for $40.