XCPE Botnet: Is Your Android TV Box Hacked? What to Do Now

Google and a group of security partners said on Nov. 2, 2026, that they had dismantled XCPE, a botnet hidden inside more than 1.3 million TV set-top boxes, most of them inexpensive Android TV boxes. According to Google’s Threat Intelligence Group, the device maker Videostrong Technology Co. built the backdoor into the boxes and sold access to criminals, who used owners’ home internet connections for ad fraud and residential proxy networks. The servers that controlled the botnet are down, but the backdoor is still on the boxes, and owners cannot remove it themselves.

Key points

• The backdoor, called x.cpe, sits in the box’s firmware and reinstalls itself if you delete it.
• Google attributes it “with high confidence” to Videostrong Technology Co.
• Google says the takedown also cuts criminals off from at least 10 million other infected devices.
• If your box is affected, disconnect it and plan to replace it. A factory reset may not remove the backdoor, which lives in protected firmware.

How the XCPE Backdoor Works

XCPE turned ordinary TV boxes into a botnet, a network of devices that criminals control remotely. According to Google’s report, it worked in three layers:

1. A hidden system app. A small program named x.cpe (com.oemservice on some boxes) is preloaded in the firmware with system-level access. If a user uninstalls it, it reinstalls itself from a protected part of the firmware the next time the box restarts.
2. A remote control channel. The backdoor checks in with the operators’ servers and waits for orders. Through it, the operators could install apps silently, run commands, capture the screen, and map the home network. Before installing anything, it switched off Google Play Protect’s app checks.
3. Paid add-ons for criminals. Videostrong sold access to other criminal groups and loaded their programs onto the boxes. Most of these turned the box into a residential proxy or used it for bandwidth sharing, which rents out your home internet address so someone else’s traffic appears to come from your house. Others faked ad views or loaded other malware.

Google says it saw the operators take live screenshots, inject keystrokes, and copy account details, device information, app lists, and system logs from infected boxes. Google ties two of the add-on programs, Moyu and Bird, to the BadBox operation. The FBI warned consumers about that operation, known as BADBOX 2.0, in a June 2025 public service announcement.

Most infected devices were Android TV set-top boxes, but Google also found the backdoor on telehealth devices, karaoke machines, and digital signage. (For more background on this kind of threat, see our explainers on backdoor attacks and pre-installed malware on Android devices.)

Google says it used legal action to take down the botnet’s control servers and the control domains of more than a dozen malware families. It also banned Videostrong and any future subsidiaries or affiliates from making certified Android devices or supplying software to other certified vendors. Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI worked with Google on the operation, according to Google’s report.

Is My Android TV Box Affected?

There is no single test, but these checks will tell you whether your box is likely part of XCPE. Work through them in order.

1. Check the brand and model. Researchers at Synthient and Plume link MECOOL-branded boxes to Videostrong, and Synthient found the backdoor already installed on a MECOOL KM9PRO Max it bought. Synthient has published a list of 182 device model names seen in the campaign. A match is a strong warning sign, not proof: the list itself says a model name alone does not confirm infection. A box that is not on the list is not automatically safe, because Videostrong also makes boxes sold under other brands.
2. Look for the backdoor app. On the box, open Settings, then Apps, and choose the option to show system apps. If you see x.cpe, com.oemservice, or com.abc.nexus, treat the box as infected. These are the package names Google published. Not finding them does not clear the box: since August 2026, the operators have also installed extra apps disguised as Android system apps, with names such as com.android.system.ntp.
3. Check whether Play Protect was turned off. The XCPE backdoor disables Google Play Protect’s app checks. If you find Play Protect’s app scanning switched off and you did not turn it off, treat that as a red flag.
4. Watch your home network. The FBI lists unexplained internet traffic as a possible sign of an infected device. Check your router’s app or admin page for heavy data use by the TV box, especially when nobody is watching anything.

Warning Signs Your TV Box Is Part of a Botnet

Doesn’t Play Protect Certification Protect Me?

Not in this case. Google requires device makers to pass compatibility and security tests before they can ship Google’s apps, but Google says Videostrong hid its code to get through a gap in those tests and loaded the malicious parts only after the box first started up. Plume found both Google-certified boxes and uncertified boxes in the botnet. Google has not said how many certified devices were affected.

Google says it has changed its review process and is improving how it checks firmware on certified Android TV devices. Certification is still worth checking for, but it is not proof that a particular box is clean, so check the other signs above as well.

What to Do If Your TV Box Is Affected

1. Unplug it from your network. Remove the Ethernet cable and forget your Wi-Fi network on the box, or simply power it off. This stops your connection from being used as a proxy and cuts the operators’ access to your home network.
2. Don’t count on a factory reset. The backdoor lives in the box’s firmware, which a reset does not replace, and it reinstalls itself after it is deleted. Plume suggests a full reset to clear any extra programs the operators added, but researchers disagree on whether any home fix works: TrendAI says cleanup needs vendor action, platform protection, or replacement of the device, and Synthient advises throwing these boxes away.
3. Replace the box. Contact the seller or marketplace and ask about a return or refund, and keep your receipt, order details, and the model number. Recycle the old box as electronic waste rather than passing it on to someone else.
4. Change passwords for accounts you used on the box. That includes streaming services, your Google account, and any other app you signed in to. Google observed the operators capturing screens, injecting keystrokes, and copying account details, so assume anything typed on the box may have been seen. Turn on multi-factor authentication where it is offered.
5. Secure your router. Change your Wi-Fi password and the router’s admin password, and remove any devices you don’t recognize. If your router supports a guest network, put streaming boxes and other smart devices on it, apart from your computers and phones.
6. Check your other devices. If a phone or tablet shares the network and is behaving oddly, follow our steps to remove malware from an Android device.
7. Watch your accounts. Look out for login alerts, password-reset emails you didn’t request, or charges you don’t recognize. If you entered payment details on the box and see charges you didn’t make, call your bank or card issuer. If someone opened accounts or used your identity, report it and get a recovery plan at IdentityTheft.gov.

How to Buy a Safer Android TV Box

Google recommends buying set-top boxes only from reputable manufacturers, and it keeps a list of its Android TV partners you can check before you buy. Skip boxes sold as “unlocked” or able to access free content, which the FBI lists as a possible sign of a compromised device. Once the box is set up, keep Google Play Protect on, install apps only from official app stores, and pass on any app that offers to pay you for your unused bandwidth. Google says those apps are one of the main ways illicit proxy networks grow.

How to Report It

• FBI Internet Crime Complaint Center: If you think a device on your network was used for criminal activity or someone got into your accounts, file a report at ic3.gov.
• Federal Trade Commission: Report a seller or marketplace listing that sold you an infected device at ReportFraud.ftc.gov.
• The seller or marketplace: Report the listing so others don’t buy the same device.
• Local police: File a report if you lost money.

Google warns that when one part of this criminal supply chain is disrupted, operators quickly switch to new loaders and tools. If your TV box matches the signs above, unplug it and replace it rather than waiting for a fix.

The post XCPE Botnet: Is Your Android TV Box Hacked? What to Do Now appeared first on McAfee Blog.