Google Dismantles XCPE Botnet Built Into 1.3m TV Boxes

Google has taken down a botnet that lived in the firmware of more than 1.3 million Android TV boxes. It says the maker, Videostrong Technology, put the malware there on purpose and then sold access to criminal affiliates.

Malware that shipped with the device

The botnet is called XCPE. Most botnets spread through software flaws or by tricking users into installing something. XCPE was embedded in the firmware during manufacturing, and Google says it appeared across several brands and models over multiple years. Google's Threat Intelligence Group said it assesses with high confidence that the backdoor was built and run for financial gain by Videostrong.

The core component runs with Android system-level privileges. After a box starts, it contacts a command server to get the details for a message broker, and the broker then delivers instructions. According to Google, operators could silently install apps, disable Google Play Protect, run shell commands, capture screenshots, inject keystrokes and collect account and device data.

How the access was monetised

The backdoor worked as a plug-in platform. Other operators installed their own modules. Some turned the boxes into residential proxies that route outside traffic through the owner's connection without consent. Another use was ad fraud: hidden page loads, ad clicks and generated impressions. Some installed further backdoors.

Google says the operators kept changing the design to avoid detection. In late 2024 they added a separate loader for the malicious modules. From August 2026 they began replacing it with smaller droppers disguised as Android system apps.

The takedown

Google and partners took down the command servers behind more than a dozen related malware families. That cut off access to at least 10 million additional compromised devices, infected by other routes. They include retail set-top boxes, karaoke machines and telehealth hardware, and not all run Android. Japan's National Police Agency and the security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI took part.

Google ended its relationship with Videostrong. It revoked the company's licence to build Android TV devices with Google apps. Videostrong and any future affiliates are also shut out of certified Android hardware and of software supply to certified vendors.

How the maker was identified

Synthient traced the backdoor after finding it preinstalled on a MECOOL KM9PRO Max box bought in late 2025. It found an open directory on a server used by the malware, with a document by the research director of Videostrong. A Videostrong domain pointed to the same IP address as the command server, and company email addresses had been used to sign backdoors. Google says this points to a deliberate decision, not a rogue employee or an oversight. It has also changed its certification review after learning that Videostrong used obfuscation to hide malicious code that loaded after first boot.

The disruption does not clean the boxes. The malware reinstalls itself from the /oem/ partition if it is removed. Owners need to install clean firmware, or disconnect the device from the internet.

Our View

This case shows a weak point in the supply chain: a certified vendor that, according to Google, planted the malware itself. Google's change to certification review addresses part of that, but it is unclear how many boxes remain in homes. Whether owners can get clean firmware is the practical question, since a licence revocation does not fix a device already sold.

Source: BleepingComputer