The backdoor was put there at the factory, survives restarts and can't be removed by owners. Here's how to tell if your cheap streaming box is at risk.
Google says Chinese box maker Videostrong built a hidden backdoor into the firmware of more than 1.3 million Android TV boxes, some sold with Google's certified badge, and rented access to criminals.
Those groups used the boxes for ad fraud and to route strangers' internet traffic through owners' homes. The backdoor could also switch off Play Protect, install apps silently, take screenshots and copy account details.
If you own a budget box from an unknown maker or MECOOL, unplug it from your network, change passwords you used on it from another device, and replace it with a streaming device from a well-known brand.
More than 1.3 million cheap streaming boxes were quietly working for criminals, and the malware didn’t come from a dodgy app. Google says the company that built them, Shenzhen-based Videostrong Technology, put the backdoor in at the factory, then sold access to it.
If you plugged a budget Android TV box into your TV in the last few years, this is worth five minutes. Infected boxes were used for ad fraud and to route other people’s traffic through owners’ home internet, and the hidden code can’t be deleted by the person who owns the box. Google has now cut the criminals off, but the Android TV box malware is still sitting inside affected devices.
The malware, which Google calls XCPE, lives inside the box’s firmware, the core software that runs before you ever open an app. Its main pieces show up as two system apps, x.cpe and com.oemservice, and they run with full system-level access.
Once a box starts up, the backdoor phones home to servers run by the operators and waits for orders. Google’s Threat Intelligence Group says it gave them a frightening amount of control:
Google says it saw the operators actually use several of these powers, not just have them. It also says this wasn’t one rogue engineer or a coding mistake. The company believes the backdoor was built and run on purpose, for money, across many models and brands over several years.
Videostrong rented out its backdoor like a platform. Paying criminal groups loaded their own add-on modules onto the boxes, and most of them did one of two things.
The first was turning boxes into residential proxies. That means strangers paid to send their internet traffic through your home connection, so it looked like it came from an ordinary household. The second was ad fraud: hidden web pages loading in the background and fake clicks on ads that nobody saw.
Some modules also dropped in more backdoors, which could pull down still more malware later. Over time the operators kept changing their tools to dodge detection. In late 2024 they added a separate loader app, and from August 2026 they began swapping that for smaller programs dressed up as normal Android system apps.
The scale is large. TrendAI, Trend Micro’s business security unit, counted 1,472,554 infected devices across 206 models between June 3 and October 1, and says the real figure is at least that high. Most were in places such as Brazil, Taiwan and Malaysia, but the US, the UK and Canada each had tens of thousands.
Videostrong makes boxes under its own name and for other brands, so the label on your box may not say Videostrong at all. The brand that comes up again and again is MECOOL. Security firm Synthient found the backdoor already installed on a MECOOL KM9PRO Max it bought, and Wi-Fi software maker Plume spotted more than a dozen device types talking to the botnet’s control server, mostly MECOOL ones.
Synthient has published a list of 182 model names seen in the campaign. It warns that a matching model name alone doesn’t prove a box is infected, and a missing one doesn’t prove it’s clean.
The worst part for buyers: some of these boxes carried Google’s certified badge. Videostrong’s own site was still advertising Google-certified TV boxes and sticks on November 2. Google says the company hid its code and loaded it only after a device’s first boot, which slipped past a gap in Google’s certification tests. Google says it has since changed its review process and is tightening firmware checks on certified Android TV devices.
It isn’t only TV boxes, either. The same backdoor turned up in karaoke machines, digital signage and telehealth devices.
There’s no simple button that tells you if a box has XCPE, but these checks will tell you how worried to be:
Here’s the uncomfortable answer: you probably can’t clean it. Because the backdoor is part of the firmware, deleting it doesn’t stick and it reinstalls itself on restart. TrendAI says it runs as a system app signed with the maker’s own key, so fixing it takes action from the maker, a platform-level protection, or a new device.
Plume suggests a full factory reset to clear any extra backdoors the add-on modules installed, but it doesn’t say a reset removes XCPE itself. Synthient goes further and tells people to throw affected boxes away for good.
Our advice, based on what the researchers found:
Google took legal action to seize the domains and servers that controlled XCPE, working with Japan’s National Police Agency and security firms including HUMAN Security, Lumen, Plume, Synthient and TrendAI. It also hit the control servers of more than a dozen malware families that rode on the backdoor. Because those groups spread their malware in other ways too, Google expects to cut them off from at least 10 million more infected devices.
That means an infected box should stop taking orders, at least for now. But the backdoor is still inside it, and Google itself warns that these operators switch to new tools fast when part of their setup goes down. A box that was built to betray you once isn’t one you want on your home network.
Videostrong is now banned, along with any future subsidiaries or affiliates, from making certified Android devices or supplying software to other certified makers. That stops new certified boxes, not the ones already in people’s homes.
Yes. Most come from bad apps, but in this case the malware was built into the box’s firmware by the manufacturer, so even owners who never installed anything were affected.
Mostly Android TV set-top boxes linked to Videostrong, with the MECOOL brand coming up most often. The same backdoor also turned up on karaoke machines, digital signage and telehealth devices.
Not reliably. A reset may clear extra add-ons, but the core backdoor lives in the firmware and reinstalls itself on restart, so researchers recommend replacing the box.
You're reading the quick version.
Read next
Claude Code extension on Cursor hacked? How to check your machine
A poisoned update slipped an SSH key and hidden startup scripts onto up to 5,000 computers. Removing the extension won't clean it up. Here's what will.
Pentagon investigators now treat the August outages at military grocery stores as a suspected cyberattack. Here's what's confirmed, what isn't, and why.
About 11,000 W5 PRO chargers sold on Amazon are affected. Here's how to tell in ten seconds, how the refund works and how to get rid of it safely.
The crypto-tracing firm says an attacker used AI agents to reach its internal tools. Here's what was taken, who's exposed and what users should do now.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
