Google Bans Partner After 1.3 Million Android TV Boxes Found Infected With Malware

Google has cut ties with Videostrong Technology, a China-based device manufacturer and one of its own Android partners, after more than 1.3 million of the company’s Android TV boxes were found running a backdoor called XCPE. In a report published on November 2, Google’s Threat Intelligence Group says it is highly confident Videostrong built XCPE and put it on the boxes on purpose so it could make money off of them — and Google, along with a handful of security firms, took the botnet down last week.

Videostrong made that money by selling access to the infected boxes. Google says the buyers were criminal groups, and Videostrong would load their malware onto the boxes for them. A lot of that malware appears to have been built for ad fraud or for residential proxy networks — Google found as many as three residential proxy SDKs running on a single box. On some boxes, Google says Videostrong’s operators were even taking live screenshots and pulling account information off of them.

We’ve seen malware found pre-installed in thousands of budget Android phones before, but those were generic phones and Galaxy knock-offs. In this case, Videostrong was a certified Android partner, and Google makes those manufacturers run their devices through compatibility and security tests before they can ship with Google’s apps on them. However, it appears Videostrong hid its code so the tests wouldn’t catch it, only loading it after the first boot. Now, Google won’t let Videostrong build certified Android devices anymore, or supply software to other certified manufacturers.

According to the reports, XCPE came preloaded in the firmware of the infected boxes and runs with system-level privileges. Synthient, one of the security firms that worked with Google, says it bought a Mecool KM9PRO Max in late 2025 and found the backdoor already on it under the name “com.oemservice.” Synthient says that Mecool Android TV boxes have become popular with consumers interested in piracy, as they allow the installation of third-party apps that can get around DRM.

Each time a box starts up, XCPE sends Videostrong’s servers some details about it like its serial number and MAC address, then waits for orders. The operators could then tell it to install apps without the owner knowing or run shell commands. Synthient estimates that roughly half a million of the 1.3 million boxes are still talking to those servers every day. Most of them are in Malaysia, Mexico, and Brazil, but there are infected boxes in the U.S. as well.

Google says it also found XCPE on telehealth devices, karaoke machines, and digital signage. As part of the takedown, the company went to court to shut down the domains and servers Videostrong used to run the botnet, along with the servers behind more than a dozen malware families that were being pushed to the boxes through XCPE. Those malware families weren’t only spreading through XCPE, so Google says taking down their servers should cut criminals off from at least 10 million more infected devices. This is the second time in 2026 that Google has gone after something like this. In January, it took down one of the biggest security risks to Android users when it disrupted IPIDEA, a residential proxy network running on millions of devices.

Checking a box for XCPE isn’t easy. Since August 2026, some of the boxes have been getting newer versions of the malware that Google says are disguised as Android system apps, with names like “com.android.system.ntp.” Synthient has posted a list of more than 180 device models tied to the campaign, including the KM9PRO. Of course, just because a model name exists on a list doesn’t mean that a compromised system has been confirmed. It also suggests using an online service to see if your IP address is being used as a residential proxy.

Google recommends making sure Play Protect is turned on. On Android TV boxes running Android 11 or newer, the setting is in the Google Play Store app under Menu > Play Protect > Settings. Boxes on Android 10 or lower have it under Settings > Apps > Security & restrictions instead, where it’s called “Verify apps.” Play Protect might not do much against XCPE, though, because Google found that the backdoor can switch off Play Protect’s app verification.

Uninstalling XCPE won’t fix the problem, either. If the backdoor gets removed, it reinstalls itself from the box’s firmware the next time the box restarts. That’s why Synthient says owners should remove the devices from their networks and change their Wi-Fi passwords and update their router firmware. The FBI warned earlier this year that your streaming device could be spying for hackers. Now it seems that potential could go up if you’re using a cheap, off-brand box. Google says it has also updated its review process so other manufacturers can’t get malware past its tests the way Videostrong did.