www.it-connect.fr
1.3 Million Android TV Boxes Factory-Backdoored by Their Maker
More than 1.3 million Android TV boxes were part of a botnet, and the infection was not caused by a cybercriminal: it was their manufacturer. Google has just dismantled XCPE and accuses Videostrong of compromising its own devices straight out of the factory. Here’s what we know.
On November 2, 2026, the Google Threat Intelligence Group published a report about the XCPE botnet, taken down a few days earlier with help from the Japan National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. Google believes the backdoor built into the Android TV boxes was developed and operated by Videostrong Technology, an Android manufacturer that also markets its boxes under the MECOOL brand. And this little scheme appears to have been in place for several years.
That said, this is not an isolated case. I notably remember BADBOX 2.0 (June 2025), which infected more than one million Android devices, a few months after the operation that allowed Germany to neutralize the first version of BadBox on 30,000 devices. At the time, the affected devices were running Android Open Source Project, without Google certification. With XCPE, it’s different. Videostrong had managed to pass the compatibility and security tests Google imposes on manufacturers. It got around them with obfuscated code loaded only after the first boot.
But now Videostrong has been exposed, and this brand will no longer be able to manufacture or sell certified Android devices, nor provide software to other certified manufacturers. Google has also filed legal action to shut down the botnet’s domains and servers, as well as those of more than a dozen malware families delivered through this backdoor.
A Backdoor Built Into the Firmware
The malicious component identified on the Android TV boxes is called x.cpe (com.oemservice in some versions). Preinstalled in the firmware, it runs with system-level privileges and therefore has more permissions than a standard application.
If the user removes it, it reinstalls itself at the next reboot from a hidden copy stored in the firmware. As soon as the box is powered on, it is listening and ready to receive commands from operators (via MQTT). Google’s report highlights the following capabilities in particular:
- Install applications: the box downloads and installs apps without the user seeing anything.
- Disable Play Protect: Android’s built-in antivirus is turned off, and it no longer checks installed apps.
- Take control: operators can run commands on the box, see what is displayed on screen, and simulate remote-control button presses.
- Explore the network: the box serves as a foothold to map the network it is connected to (ping, whois, traceroute, etc.).
A factory reset is not enough to get rid of the malicious components because they are stored in the device firmware. In addition, since August 2026, new malicious components have been using Android-like names, such as com.android.system.ntp, which suggests the system time-sync service. That helps them blend into the application list.
Your Box, Someone Else’s Residential Proxy
Videostrong built a real business model around this malicious activity. In fact, Videostrong sold access to its infected boxes to affiliates, who then dropped their own malicious modules on them. Some simulated ad views to make money (ad fraud), while others added new backdoors. But the main business was residential proxying.
The idea: the box acts as an Internet exit point for strangers. Their traffic passes through your connection and appears with your Internet box’s public IP address. For a website, the attacker’s connection therefore looks like that of an ordinary private user. Google cites modules linked to Linkfog, AppSalt (Honeygain’s development kit), NetNut, and Traffmonetizer. Some boxes had up to three of them installed at the same time, in order to maximize the profitability of each device.
For its part, Synthient dissected a MECOOL KM9PRO Max box and links the operation to Videostrong, notably through a document signed by its head of R&D. Around 500,000 compromised devices are believed to be online, mainly in Malaysia, Mexico, and Brazil. Small detail: references such as KM1, KM6, KM7, and KM9PRO, which match MECOOL model names (official boxes or clones, impossible to say), had already appeared in the list of devices associated with BADBOX 2.0 published by HUMAN in 2025. The investigation reveals that devices used for telemedicine and digital signage are among the infected equipment.
If we refer to the map published by Google, France appears to be spared by this malicious campaign.
What Should You Do?
As I said earlier, resetting the system does not remove the malicious strain because it is stored in the firmware. As a result, Synthient’s recommendation is drastic: stop using the compromised hardware. Here are a few other recommendations:
- Monitor DNS: resolutions to
szbboys[.]comoranyevonline[.]comin Pi-hole, AdGuard Home, or firewall logs should raise alarms, as should outbound traffic to ports 3885 to 3887. - Segment IoT: a TV box has no business being on the workstation or NAS network. A dedicated VLAN limits the damage.
- Choose your hardware carefully: Google points to its list of certified partners, which mainly covers smartphones and tablets. But Videostrong itself passed the tests. Certification remains a filter, but it is not foolproof…
