Google has banned the Chinese device maker Videostrong from building certified Android devices after concluding that the company deliberately placed a backdoor in its TV boxes and sold access to criminals. Google and industry partners took down the servers that controlled the network, called the XCPE botnet, in late October. Google announced the action on 2 November 2026.
The botnet included more than 1.3 million Android devices, mostly TV set-top boxes. Security researchers warn that the backdoor itself remains on the hardware.
What Google Announced
Google said it is highly confident that Videostrong built the backdoor, known as x.cpe, into the firmware of many device models and brands over several years. According to Google, the evidence does not point to a rogue employee or a mistake.
Google used legal action to take down the domains and servers that controlled the botnet, along with the control domains for more than a dozen malware families loaded through the backdoor. Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI helped with the operation, according to The Hacker News.
Google has cut ties with Videostrong. The company, along with its future subsidiaries and affiliates, can no longer build or sell certified Android devices or supply software to other certified makers.
How the Backdoor Worked
Google’s analysis shows x.cpe ran as a system app inside the firmware with system-level access. It contacted control servers for instructions and switched off app checks in Google Play Protect before installing software silently.
The botnet’s operators could install apps without the owner knowing, run commands, capture the screen and map the home network. Google says it saw Videostrong’s operators use some of these abilities, including taking live screenshots and copying account details and system logs.
Most of the extra programs turned the boxes into residential proxies, which let paying customers route traffic through an ordinary household connection. Others faked views of online ads.
Scale and Affected Devices
TrendAI counted 1,472,554 infected devices across 206 models between 3 June and 1 October. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. India was not among the top countries in the figures reported. Most infected devices were TV boxes, but the code also appeared in telehealth devices, karaoke machines and digital signage.
Google estimates that taking down the control domains should cut off access to at least 10 million more compromised devices, because the criminals who bought the backdoor spread malware by other means too.
Synthient published a list of 182 device model names seen in the campaign and focused on MECOOL-branded boxes, which it links to Videostrong. It cautions that a model name alone does not prove a device is infected. Android Authority says the likely culprit is the company behind MECOOL TV boxes. Neither Google’s statement nor the sources I saw give a verified count of affected certified devices.
How Google Says It Got Past the Tests
Videostrong’s boxes were sold as certified Android devices, which suggested they were safe. Google says the company used hidden code to exploit a gap in its tests and loaded the malicious code after the first boot. Google called deliberate infection by a device maker an unacceptable breach of trust, and it is changing its review process and improving checks of firmware on certified Android TV devices.
What Owners Should Do
This is general information, not a guarantee of safety. The takedown severs the botnet’s control, but security researchers say owners cannot remove the backdoor themselves. According to TrendAI, because the app is built into the firmware and signed with the maker’s key, removal needs the vendor, platform protection or device replacement.
- Check the model: Compare your box against Synthient’s published list of model names.
- Consider replacing it: Synthient advises discarding affected boxes as high risk, and Plume recommends at least a factory reset, though it does not say a reset removes x.cpe.
- Isolate smart devices: Keep TVs and set-top boxes on a separate network from computers and work devices.
- Buy from established brands: Choose devices from reputable manufacturers with regular security updates.
Why It Matters
This case differs from earlier botnets, because Google points to the manufacturer itself as the operator. It shows that the certification label does not guarantee a safe device. Low-cost streaming boxes are popular in India as well, so buyers of unbranded or little-known models should watch for advisories.
What Happens Next
Google says backdoor operators and their customers quickly switch tools after a disruption, so new infrastructure could appear. Expect more research from the partner companies and possible regulatory attention on device certification. Any further action against Videostrong has not been announced.
FAQs
What is the XCPE botnet?
A network of more than 1.3 million Android devices, mostly TV boxes, controlled through a backdoor in their firmware.
Who built it?
Google says it is highly confident Videostrong, a Shenzhen-based device maker, built the backdoor.
What did Google do?
It took down the control servers and domains and banned Videostrong from making certified Android devices.
Are the devices safe now?
Researchers say the backdoor stays on the boxes and cannot be removed by owners.
Which brand is most affected?
Researchers at Synthient focus on MECOOL-branded boxes, which they link to Videostrong.
How do I know if my box is affected?
Compare the model name against Synthient’s list, though a match alone does not confirm infection.
