Google Disrupts XCPE Botnet in 1.3m Android TV Boxes

Google and industry partners have disrupted the XCPE, or X.CPE, botnet, which the company says had enrolled more than 1.3 million set-top boxes worldwide. Google announced the operation on 2 November, saying the affected hardware was primarily Android TV boxes, with some Android-based telehealth equipment, karaoke machines and digital-signage devices also involved.

Ars Technica reported that tens of thousands of affected devices were online in the UK, although a precise total has not been published. The case is unusual because Google said the devices were Google-certified Android products, rather than simply unofficial streaming boxes.

Firmware backdoor operated at system level

Google’s Threat Intelligence Group assessed with high confidence that Shenzhen-based Android OEM and ODM Videostrong Technology developed, deployed and operated the backdoor for financial gain. Google said Videostrong sold access to criminal affiliates, which used infected devices for residential proxy services, advertising fraud, additional malware delivery, data collection and routing malicious traffic through household internet connections.

The main component, known as x.cpe or com.oemservice in some firmware versions, was embedded in firmware and ran with Android system privileges. Google said that if it was removed from the normal application area, it could reinstall after a reboot from the device’s /oem/ partition.

According to Google, the malware could silently install apps, disable Play Protect, run commands and scripts, take screenshots, inject keystrokes, collect device and account information, probe local networks and establish reverse shells.

Infrastructure disruption is not a full clean-up

Google said it used legal action to take down Videostrong servers and domains, alongside command-and-control domains used by more than a dozen malware families. The company also banned Videostrong, its future subsidiaries and affiliates from making certified Android devices or supplying software to other certified vendors.

However, the action does not confirm that malware has been removed from every affected device. Ars Technica reported that Play Protect remained disabled on affected boxes, inactive modules could remain installed, and the system-level components were not easily removable by users.

MECOOL names appear, but they are not a recall list

Ars Technica identified the MECOOL KT1 as one device in the botnet and reported that most affected boxes were sold under the MECOOL brand alongside white-label hardware. Synthient published 182 observed model strings, including KM1, KM2, KM3, KM6, KM7, KM8, KM9, KT1, KT2, Strong LEAP-S1 and generic names such as 4K Android TV Box.

That list should be treated carefully. Synthient explicitly said a model name appearing in its research does not prove that every individual unit of that model is infected; it records strings seen during the campaign, not a definitive recall list.

Why this matters for UK buyers

The important detail is not simply that cheap or unfamiliar TV boxes were targeted. Google said the backdoor was concealed in devices that had passed Android certification, using obfuscation and loading malicious code after first boot to evade obvious detection during pre-release checks.

Google says it has updated its firmware-integrity and certification-review processes for Android TV devices. But there is no confirmed replacement scheme, refund process or universal firmware-cleaning method for owners of potentially affected hardware, leaving the disruption of the criminal infrastructure distinct from a confirmed fix for every box already in homes.