.png "Global Insight")
Your television box may have been working a second job without telling you. On November 2, Google said it had disrupted a botnet called XCPE that lived inside more than 1.3 million Android set-top boxes, most of them TV boxes, and that the company behind many of those boxes had built the backdoor in on purpose and then sold access to criminals. According to Google's Threat Intelligence Group, the operation, carried out with partners including Japan's National Police Agency and security firms, cut off the se
rvers that controlled the botnet — but it did not remove the malicious code from the boxes themselves
.
The central accusation is unusually direct. Google attributes the backdoor, with high confidence, to Shenzhen-based Videostrong Technology, which sells Android TV boxes under its MECOOL brand and builds devices for other labels. Google says Videostrong intentionally developed, deployed and operated the backdoor for financial gain, hid its code so it would slip past Android's compatibility and security checks by loading after a device's first boot, and tied it to its own YokaTV Player app. Google has now cut ties with the company and banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors.
How a box becomes a botnet
XCPE — also written x.cpe — was not an app a user downloaded by mistake. It was pre-installed in the device's firmware, the software that controls the box's basic operations, before the box ever reached a living room. Once active, an infected box could be rented out, in effect, as part of a criminal infrastructure: routing other people's internet traffic as a residential proxy, generating fake ad views, capturing screens, opening remote shells, stealing data, and downloading further malware. The owner would typically notice nothing — the box still played video — while their home broadband connection quietly served strangers.
The scale is what makes this case different from a single bad app. Google counts more than 1.3 million devices enrolled in XCPE across more than 200 countries, and says that shutting down the control domains used by affiliated criminal groups should also cut those groups off from at least 10 million additional compromised devices that caught their malware through other channels. One research partner counted about 1.47 million infected devices across 206 models and warned that owners cannot remove the implant themselves, because it lives in the system partition rather than in an app that can be uninstalled.
Why the takedown is not a clean-up
This is the part that matters most for anyone who owns an affected box. Taking down command-and-control servers stops the operators from issuing new orders, but the backdoor code remains on the device. Security researchers quoted in coverage of the takedown stress the same point: a server seizure is not a factory reset, and a box that was compromised at the factory cannot be trusted again simply because its controllers went quiet. The honest advice, for boxes from the affected maker or unknown cheap brands, is to stop using the device for anything sensitive, check the maker's guidance, and replace rather than merely reboot a box that cannot be verified clean.
The wider lesson reaches beyond one brand. Cheap connected hardware is cheap partly because nobody is paying for long-term security: no update channel, no accountability, and a supply chain in which the company that assembles the box may also be the company that profits from compromising it. Google says it has since updated its review process to close the gap Videostrong exploited. For buyers, the XCPE story is a simple rule of thumb — a TV box is a computer on your home network, and a bargain box from an unknown maker deserves the same suspicion you would give a bargain laptop. Related reading: Anthropic Blocks Claude Code From Recreating Existing Games and Ukraine Air-Alert App Hacked With False Radiation Warnings.