XCPE: The Factory Backdoor That Turned 1.3 Million Android TV Boxes Into a Botnet

Your TV box might be working for someone else. On November 2, 2026, Google's Threat Intelligence Group published a report on a botnet called XCPE: more than 1.3 million Android TV boxes, quietly enrolled into a criminal network. The part that makes this one different is how the infection happened. Nobody hacked the boxes after they were sold. The company that manufactured them built the backdoor in at the factory — and then sold access to criminals.

The backdoor was built in at the factory

Google's Threat Intelligence Group assesses with high confidence that Videostrong Technology Co., an Android device maker based in Shenzhen, China, deliberately developed, deployed and operated the backdoor and the botnet for financial gain. Google is explicit that this was neither the work of a rogue insider nor a development oversight. The manufacturer was the attacker.

The core component is an app called x.cpe, sometimes named com.oemservice. It runs with Android system-level privileges — the highest everyday level on the device. When an infected box starts up, it contacts a command-and-control server on the anyevonline.com domain to obtain credentials for an MQTT message broker, then waits for orders. From that point on, whoever holds the keys can push new software onto a box sitting in someone's living room.

Synthient, one of the security firms in the takedown, traced the backdoor to Videostrong after discovering it preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025. MECOOL products and a storefront called YOKATV were linked to the operation. The boxes were not bought from shady websites — they were ordinary cheap streaming boxes, sold through normal retail channels.

What the botnet was used for

Videostrong sold access to the infected boxes to criminal affiliates, who loaded their own modules for three main purposes. The first was residential proxy services — Linkfog, Honeygain, GaGaNode, NetNut and Traffmonetizer — which routed third-party internet traffic through the boxes without their owners' knowledge. The second was ad fraud. The third was data theft and installing more malware.

Put plainly: the box under the television was earning money for someone else, twenty-four hours a day, on the owner's electricity and internet connection. The owner would never see a thing. A streaming box does not have a screen full of warning pop-ups, and a backdoor running at system level does not show up in any app list.

How big it got — and how it was stopped

Google measured more than 1.3 million set-top boxes enrolled in XCPE. The spread was global: CyberScoop put it at more than 170 countries, while The Register and TrendAI cite more than 200. TrendAI logged more than 3.8 million distinct home and mobile IP addresses linked to the operation between June 3 and October 1. Synthient estimated that about 500,000 compromised devices were online at the time, mostly in Malaysia, Mexico and Brazil.

The takedown came in late October 2026, a week before Google published its report. It involved Japan's National Police Agency and the security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google took legal action to take down the domains and servers that controlled the botnet, along with the command servers of more than a dozen related malware families loaded through the backdoor. Google says that shutting down the affiliates' control servers also cut off access to at least 10 million additional compromised devices infected through other routes — that 10 million figure is Google's own estimate.

Google then punished the manufacturer. It ended its relationship with Videostrong, revoked its licence to manufacture Android TV devices with preloaded Google apps, and banned the company and its future affiliates from producing certified Android devices or supplying software to certified vendors.

The part nobody can fix yet

Here is the uncomfortable part: the takedown stopped the control servers, not the backdoor. The malware has not been removed from the infected devices — and if it is removed, it reinstalls itself from the device's /oem/ partition. A factory reset does not clean it.

Google has also not published a complete public list of every affected model and retail brand. That means owners of cheap, no-name boxes cannot check a list and relax. If your box came from a manufacturer you have never heard of, sold far below the price of a known brand, you cannot confirm from the outside whether it is clean.

What to do if you own a cheap Android TV box

1. Buy certified, from known brands. When you replace a box, buy a Google-certified Android TV device from a recognised brand through an official channel. Certification is the one check that actually means something here — Videostrong lost exactly that.
2. If you own a no-name box, assume the worst. Especially a MECOOL box or any box bought cheap from an unknown seller: disconnect it from your network and replace it. Do not spend hours trying to clean it yourself — the backdoor survives removal.
3. Look at what is on your network. Your router's connected-devices list shows every box, camera and speaker in the house. A device you do not recognise, or a box uploading data in the middle of the night, is worth investigating.
4. Do not sideload firmware or cleaner apps. Random firmware files and miracle cleaner apps from forums are how more malware arrives, not how it leaves.
5. Keep smart devices off your main network. If your router supports a guest or IoT network, put streaming boxes and smart devices on it. A compromised box should not be able to reach your laptop.

Where things stand

The control servers are down, so for now the botnet is cut off from its operators. But the backdoors are still sitting inside the boxes, waiting for new orders if new servers appear. XCPE is a reminder that the cheapest device in the house can be the least trustworthy one — and that the supply chain is part of your attack surface. When the maker is the attacker, no antivirus on the box will save you. The only real defence is buying hardware from vendors you can trust.