www.it-connect.fr
1.3 Million Android TV Boxes Factory-Backdoored by Their Maker
More than 1.3 million Android TV boxes were members of a botnet, and the infection was not started by a cybercriminal: it was their manufacturer. Google has just dismantled XCPE and accuses Videostrong of having compromised its own devices straight out of the factory. Here is what we know.
On November 2, 2026, the Google Threat Intelligence Group published a report on the XCPE botnet, which was taken down a few days earlier with the help of the National Police Agency of Japan, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. Google believes that the backdoor built into the Android TV boxes was developed and operated by Videostrong Technology, an Android manufacturer that also sells its boxes under the MECOOL brand. And this little scheme has apparently been running for several years.
That said, this is not an isolated case. I still remember BADBOX 2.0 (June 2025), which infected more than one million Android devices, a few months after the operation that allowed Germany to neutralize the first version of BadBox on 30,000 devices. At the time, the affected devices were running Android Open Source Project, without Google certification. With XCPE, it is different. Videostrong managed to pass the compatibility and security tests that Google requires from manufacturers. It bypassed them with obfuscated code loaded only after the first boot.
But now Videostrong has been exposed, and the brand will no longer be able to manufacture or sell certified Android devices, nor provide software to other certified manufacturers. Google has also filed a lawsuit to have the botnet domains and servers shut down, as well as those of more than a dozen malware families loaded through this backdoor.
A Backdoor Built into the Firmware
The malicious component identified on the Android TV boxes is called x.cpe (com.oemservice in some versions). Preinstalled in the firmware, it runs with system privilege level, and therefore has more permissions than a standard app.
If the user removes it, it reinstalls itself at the next reboot from a hidden copy stored in the firmware. As soon as the box is powered on, it is listening and ready to receive commands from the operators (via MQTT). Google’s report highlights the following capabilities in particular:
- Install applications: the box downloads and installs apps without the user seeing anything.
- Disable Play Protect: Android’s built-in antivirus is turned off, so it no longer checks installed apps.
- Take control: operators can run commands on the box, see what is displayed on the screen, and simulate remote-control button presses.
- Explore the network: the box is used as a foothold to map the network it is connected to (ping, whois, traceroute, etc.).
A factory reset of the device is not enough to get rid of the malicious components, since they are stored in the box’s firmware. In addition, since August 2026, new malicious components have been given names modeled after Android services, such as com.android.system.ntp, which resembles the system time synchronization service. Enough to blend in with the list of installed apps.
Your Box, Someone Else’s Residential Proxy
Videostrong set up a real business model around this malicious activity. Indeed, Videostrong sold access to its infected boxes to affiliates, who deployed their own malicious modules on them. Some simulated ad views to make money (ad fraud), while others added new backdoors. But the main business was residential proxying.
The idea is simple: the box acts as an Internet exit point for strangers. Their traffic passes through your connection and appears with the public IP address of your Internet box. To a website, an attacker’s connection therefore looks like that of an ordinary home user. Google cites modules linked to Linkfog, AppSalt (Honeygain’s development kit), NetNut, or Traffmonetizer. Some boxes had up to three of them installed at the same time, in order to monetize each device as much as possible.
For its part, Synthient dissected a MECOOL KM9PRO Max box and links the operation to Videostrong, notably through a document signed by its R&D director. About 500,000 compromised devices are said to be online, mostly in Malaysia, Mexico, and Brazil. A small detail: references such as KM1, KM6, KM7, and KM9PRO, which match MECOOL model names (official boxes or clones, impossible to say), were already on the list of devices associated with BADBOX 2.0 published by HUMAN in 2025. The investigation reveals that devices used for telemedicine and digital signage are among the infected equipment.
If we refer to the map published by Google, France appears to be spared by this malicious campaign.
What Should You Do?
As I said earlier, resetting the system does not remove the malicious strain because it is stored in the firmware. As a result, Synthient’s recommendation is radical: stop using the compromised hardware. Here are a few other recommendations:
- Monitor DNS: resolutions to
szbboys[.]comoranyevonline[.]comin Pi-hole, AdGuard Home, or firewall logs should raise an alert, as should outbound traffic to ports 3885 through 3887. - Segment IoT: a TV box has no business being on the workstation or NAS network. A dedicated VLAN limits the damage.
- Choose your hardware carefully: Google points to its list of certified partners, which mostly includes smartphones and tablets. The problem is that Videostrong itself was passing the tests. Certification remains a filter, but it is not foolproof…
