Home · Technology · Nov 5 archive
Google Shuts Down Malware on Over 1.3 Million Android TV Devices
Confirmed
In Short: Google severed ties with Videostrong and banned the company from its certified program after confirming it embedded malware into Android TV and Google TV devices sold over several years.
Google and an assortment of partners have shut down a botnet affecting more than 1.3 million Android TV set-top boxes, primarily targeting devices made by Videostrong Technology Co., an Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM).
The botnet, called XCPE, relied on a backdoor built directly into the device’s firmware, allowing attackers to gain access before the products reached consumers. This backdoor, known as x.cpe or com.oemservice, runs with Android system privileges and can install apps, run commands, take screenshots, type keystrokes, and collect account details, app lists, and logs.
Synthient, one of the partners involved in the shutdown, estimated that about 500,000 compromised devices were online at the time, mostly in Malaysia, Mexico, and Brazil. The malware could also switch off Google Play Protect, the built-in app checker.
The compromised devices were primarily Android TV set-top boxes, although researchers also identified infections in karaoke machines, digital signage equipment, and telehealth devices. Synthient has published a list of 182 device model names known to be included in the botnet.
Google said in a blog post that Videostrong Technology deliberately embedded the malicious backdoor into Android devices during manufacturing. The company assessed with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain.
The malware, called XCPE, was pre-installed in the firmware of these devices, allowing attackers to gain access before the products reached consumers. It kept a standing connection to a control server and could install additional modules that conducted ad-fraud, enrolled infected devices into residential proxy networks, and loaded more malware.
Google severed ties with Videostrong and banned the company from its certified program after confirming it embedded malware into Android TV and Google TV devices sold over several years. The company is tightening security reviews to close testing gaps.
The botnet's control server was used by affiliates to distribute modules that conducted ad-fraud and enrolled infected devices into residential proxy networks. Google assessed that taking down their C2 domains will sever access to at least 10 million additional compromised devices.
Google announced at the Android Dev Summit 2026 that Googlebook detachables will be the next form factor after clamshells and convertibles. Meanwhile, Android Canary 2608 rolled out today, confirmed by Google on the Android Canary subreddit and reported by 9to5Google and Android Authority, headlined by a new Quick Settings layout editor.
Just like we’d expect, we’re seeing Canary 2611 images available for devices from the Pixel 6a, up through this year’s Pixel 11 family. Last month, we were over a week into October before Android Canary 2610 debuted, so it’s nice to see Google getting right down to business, so early in.
With prices up to $350 off, it’s a good time to consider upgrading if you’re looking for a great Android phone.
What this adds
Google has confirmed that an Android TV device maker snuck a backdoor for malware onto certified devices, leading to security improvements for the ecosystem as a whole.
The malware, called XCPE, was pre-installed in the firmware of these devices, allowing attackers to gain access before the products reached consumers.
The compromised devices were primarily Android TV set-top boxes, although researchers also identified infections in karaoke machines, digital signage equipment, and telehealth devices.
Background
Google has confirmed that an Android TV device maker snuck a backdoor for malware onto certified devices, leading to security improvements for the ecosystem as a whole.
Google has shut down a malware backdoor on more than 1.3 million Android TV devices, primarily set-top boxes.
What's confirmed
- Its trail began with a MECOOL KM9PRO Max box bought in late 2025 that already carried the malware when it arrived. The main component goes by x.cpe or com.oemservice and runs with Android system privileges, which is the highest everyday level on the device. It keeps a standing connection to a control server and can quietly install apps, run commands, take screenshots, type keystrokes and collect account details, app lists and logs. It can also switch off Google Play Protect, the built-in app checker. The money came from modules supplied by paying affiliates.
- Synthient, one of the partners, estimated that about 500,000 compromised devices were online at the time, mostly in Malaysia, Mexico and Brazil.
- Writing in the Google Cloud blog, the Google Threat Intelligence Group said it assessed with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co., an Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM).
- The compromised devices were primarily Android TV set-top boxes, although researchers also identified infections in karaoke machines, digital signage equipment and telehealth devices.
- These secondary modules were conducting ad-fraud; silently enrolling infected devices into residential proxy networks; and loading additional malware onto XCPE-compromised devices.
What's still developing
- Meta has been developing wearable computers for a while now, including VR and lighter XR headsets, often citing that they’re devices for the post-smartphone era.
- That means it’s sure to tie in with your Android-powered smartphone better than anything else on the market, something we’ve seen from Wear OS smartwatches.
- Samsung Intelligent Eyewear also has the advantage of having Gemini onboard and running Android XR, the official Google-built operating system for smart glasses and VR headsets.
- A few tweaks made long road trips less chaotic Nothing annoyed me more than Android Auto disconnecting in the middle of a drive.
- Parth is a technology analyst and writer specializing in the comprehensive review and feature exploration of the Android ecosystem.
- His work focus on productivity apps and flagship devices, particularly Google Pixel and Samsung mobile hardware and software.
- "Create a grocery list in Google Tasks for my weekend run."
- Google says an update is rolling out to fix Android Auto connection problems affecting Samsung Galaxy phones that have installed the One UI 9 update.
- What was the primary connection method Android Auto required when it first launched?
- Several users have reported that Android Auto is no longer connecting properly after installing the Android 17-based update.
- Over the past several months, countless users have reported experiencing wired and wireless Android Auto disconnects, especially with Samsung and Pixel devices.
- Start powering your devices with it now by picking it up for $40.