Global Botnet XCPE Compromises Over 1.3 Million TV Boxes Worldwide
Přes 1,3 milionu television boxes across more than 200 countries have been integrated into a global botnet named XCPE, according to an announcement made by Google on November 2, 2026. Google reported that it worked alongside security firms and Japanese police to disrupt the command-and-control infrastructure of the network, attributing the commercial operation of the malware directly to Videostrong Technology.
The infiltration bypassed standard application downloads and phishing links. A backdoor loader designated as x.cpe, which appears in certain builds under the name com.oemservice, was embedded directly into the system partition of the device firmware. According to security findings, Videostrong bypassed compatibility and security tests so that the malicious code loaded onto the hardware only after its first boot sequence. Once configured, the backdoor established a persistent connection through the MQTT protocol to receive operational commands.
System-Level Control and Commercial Exploitation by Videostrong
Videostrong monetized the compromised units by selling access to other criminal groups. The operators uploaded malicious modules into the hardware to execute advertising fraud, install additional malware, and integrate the devices into residential proxy networks. These networks routed external internet traffic so that it appeared to originate from the legitimate user’s IP address.
Because the malicious code operated with system-level privileges, operators maintained extensive control over the hardware. Investigations by Google showed that the botnet could capture screenshots, simulate remote keystrokes, execute system commands, and harvest account login details, device parameters, application lists, and system logs. The malware disabled Google Play Protect and installed additional software without the user's knowledge.
Google Terminates Partnership with Manufacturer After Backdoor Discovery
Security analysts from the firm Synthient identified the same backdoor inside the MECOOL KM9PRO Max test box. The malicious code also appeared in karaoke stations, medical devices, and digital information panels. In response to the operation, Google terminated its partnership with Videostrong, issuing a ban that bars the firm and its future subsidiaries or affiliates from manufacturing and selling certified Android devices or supplying software to other hardware producers. Google also updated its security verification procedures to strengthen firmware integrity checks for Android TV equipment.
Google severed operator access to additional devices infected through alternate vectors by shutting down command domains. However, infrastructure shutdowns do not remove the infection from individual boxes. Manual file deletion fails because the backdoor reinstalls itself from the /oem/ system directory during every system reboot. Remediation requires an authorized manufacturer intervention, a verified clean firmware image, or complete hardware replacement. Since Videostrong is not expected to issue clean firmware for these devices, and users cannot delete the code from the system partition, disconnecting and discarding the compromised hardware remains the only complete mitigation.
Frequently Asked Questions About the XCPE Botnet
How did the malicious code reach the system partition of the television boxes?
Videostrong Technology integrated the x.cpe loader directly into the system firmware. The code bypassed compatibility and security testing by executing only after the device completed its initial startup configuration.
‼️ BREAKING – Google disrupts a 1.3 million-device Android botnet and bans TV box maker Videostrong. Google says the company deliberately built a backdoor into its devices and sold access to criminals. The control servers are down. The backdoor is still there. Full story:… pic.twitter.com/J5JMXBFmun
Can standard antivirus software or manual file deletion remove the infection?
No. Manual file deletion fails because the backdoor reinstalls itself automatically from the /oem/ system directory every time the device restarts.
What types of hardware beyond standard television boxes contain the backdoor?
Security analysts from Synthient discovered the backdoor in equipment including karaoke stations, medical devices, and digital information panels, alongside the MECOOL KM9PRO Max test box.
More on Android
Your Android TV box could be secretly working for hackers. Google has disrupted a massive botnet involving 1.3 million devices and banned Chinese TV box maker VideoStrong. The worrying part? Some infections may survive a factory reset. Is your device at risk? Read more:…