Google Takes Down a 1.3 Million Device Android Botnet Hidden in TV Boxes

Millions of small Android TV boxes sat in living rooms doing far more than playing video. According to reports published on November 2, 2026, Google led a coordinated takedown of a botnet hidden in more than 1.3 million Android devices, most of them TV set-top boxes. The company says it is highly confident that the device maker Videostrong intentionally built a backdoor into the boxes and sold access to criminals. For owners, the unsettling part is simple: the backdoor lives in the firmware, so a normal uninstall will not remove it.

What Google announced

Google, working with partners including Lumen, HUMAN Security, Plume, Synthient and TrendAI, plus Japan's National Police Agency, disrupted the botnet known as X.CPE. The operation took down the domains and servers that controlled the infected devices in late October, and the details were reported on November 2. Google also took down control domains for more than a dozen malware families that had been loaded through the backdoor.

The scale is what makes this case stand out. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1, and said the real number is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most infections. The United States, Germany, the United Kingdom, Australia and Canada each had about 26,000 to 42,000 infected devices, according to the same count. Because the criminals behind the malware also spread it through other routes, Google expects the action to cut off their access to at least 10 million more infected devices.

Google has also cut ties with Videostrong. The company, based in Shenzhen, China, is now banned from building or selling certified Android devices and from supplying software to other certified device makers. That ban also covers any future subsidiaries or affiliates. As of November 2, Videostrong's own website still listed products it calls Google Certified Android TV Box and Google Certified Android TV Stick, a reminder that a label on a product page is not proof of current certification.

How the backdoor worked

The backdoor, called x.cpe, runs as a system app inside the firmware, with system level access. According to Google's analysis, it reported to command and control servers and waited for orders. Before installing software silently, it first turned off the app checks in Google Play Protect, Android's built in security feature.

Through that backdoor, operators could install apps without the owner knowing, run commands, capture the screen and map the network the box sits on. Google says it saw Videostrong's operators use some of these powers directly. They took live screenshots, sent keystrokes, copied out account details, device information, app lists and system logs, and opened reverse shells, which give a remote command line into the box.

Most of the criminal modules loaded through the backdoor had a quieter commercial purpose. They turned the boxes into residential proxies or sold their spare bandwidth. A residential proxy service sells access to a home internet connection, so a customer's traffic appears to come from an ordinary household. Other modules faked views of online ads. In plain terms, an infected box in a living room could be rented out, in effect, to hide someone else's traffic or inflate ad numbers, without the owner ever seeing a warning.

Why owners cannot just delete it

This is the hardest part of the story for consumers. Because x.cpe is part of the firmware, removing it does not stick. Reports say it reinstalls itself when the box restarts. TrendAI says the backdoor runs as a system app signed with the maker's key, so cleanup needs vendor action, platform protection or replacement of the device.

Advice from the researchers differs in tone, but points in the same direction. Plume recommends a full factory reset, because the modules loaded through the backdoor may have installed more backdoors, but it does not say whether a reset removes x.cpe itself. Synthient goes further, telling consumers to throw the boxes away for good because they pose a high risk of malware. For organizations, Synthient recommends finding MECOOL or similar devices on the network with its published indicators, disconnecting and discarding any that turn up, blocking the control domains and IP addresses in its report, and keeping other smart devices on separate network segments away from sensitive systems.

What to check if you own a cheap Android box

Not every Android TV box is affected, and a model name alone does not confirm infection. Synthient has published a list of 182 device model names seen in the campaign, and its report focuses on MECOOL branded boxes, which it links to Videostrong. It bought a MECOOL KM9PRO Max and found the backdoor preinstalled. Plume found more than a dozen different devices using the botnet's control server, most of them from MECOOL.

Start with the brand and model on the box or in its settings menu. If it matches a name on the published indicator list, treat it as high risk, not as a confirmed diagnosis on its own. Check where you bought it and whether the seller is an established brand with a real support page and update history. A box sold mainly on price, with vague branding and no clear update policy, deserves more suspicion than a box from a major TV maker.

If you replace a suspect box, change passwords for any accounts you used on it.

Frequently Asked Questions

Is my Android TV box infected?

A model name alone does not confirm infection. Check the brand and model against Synthient's published list of 182 device model names seen in the campaign, with MECOOL boxes a particular focus. If your box matches, treat it as high risk, disconnect it if you are unsure, and consider replacing it rather than relying on a reset alone.

Will a factory reset remove the x.cpe backdoor?

Probably not on its own. Because x.cpe lives in the firmware and reinstalls itself on restart, according to researchers, a factory reset may clear added apps but does not rewrite maker signed firmware. TrendAI says cleanup needs vendor action, platform protection or replacement of the device.

Should I stop using all cheap Android TV boxes?

No, but buy with more care. Choose a known brand with a real support page and a record of updates, buy from a trusted retailer, and keep the box on a guest network if your router supports it. If credible research links your exact model to a firmware backdoor, replacement is the safer choice.