XCPE Android TV botnet: check your set-top box after Google's takedown

If you stream through a cheap Android TV box (or run another Android gadget that never asks for updates), this one is for you. In a November 2, 2026 post, Google Threat Intelligence said that the previous week it and industry partners dismantled XCPE (also written x.cpe), a backdoor that enrolled more than 1.3 million devices into a botnet. Most of those were Android TV set-top boxes. Google also saw the same implant on telehealth devices, karaoke machines, and digital signage, and TrendAI adds projectors to that list.

This is not a “you clicked a bad link” story. Google says the malware was built into the firmware before the devices were sold. Owners got no consent prompt and no opt-out.

What Google says happened

Google’s post says Videostrong Technology Co. (an Android OEM and ODM) built and ran the backdoor on purpose so it could make money from it. Videostrong sold access to criminal affiliates, who loaded modules for:

• Ad fraud
• Silent enrollment into residential proxy networks
• Additional malware on the same boxes

Google also disrupted command-and-control domains used by those affiliate modules. Because those affiliates distribute malware beyond XCPE, Google assesses the domain takedowns will sever access to at least 10 million additional compromised devices.

Partners named in Google’s post include Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. Google banned Videostrong and any future subsidiaries or affiliates from building and selling certified Android devices, and from supplying software to other certified vendors. That second clause matters for white-label brands whose firmware Videostrong supplied. Google also says it tightened firmware integrity checks for Android TV certification.

Ars Technica and SecurityWeek covered the same announcement on November 3.

Why a living-room TV box matters

A backdoored Android TV box sits on your home network. Google describes capabilities that go far beyond “someone else watches ads on your IP,” including silent app installs, shell commands, screen capture, and network reconnaissance. Affiliate modules also turned boxes into residential proxy exit nodes, so strangers’ traffic could leave through your home broadband.

TrendAI says a home owner cannot simply uninstall the implant: it is signed like a system app, so you need a vendor fix, platform protections, or a new device. Google’s disruption cuts the remote control paths. It does not erase every preloaded package that is still sitting on a shelf unit.

How to check your own box

Exact menus vary by brand. The habit does not.

1. Identify the brand and model. Look on the sticker, the Settings > About / Device info screen, or the packaging. Researchers at Synthient published a list of model names (Ars Technica counts 182) seen in the campaign (including many MECOOL names such as KM9PRO / KM9PRO_MAX). A matching model is a warning, not proof of infection. A model that is not listed is not automatically safe, because Videostrong also supplied other brands. Run the same check on Android projectors, karaoke boxes, digital signage, or telehealth gadgets in the house, not only the living-room streamer.
2. Look for the known packages. On the device, open Settings > Apps (or Applications) and show system apps if the menu offers that. Google’s primary backdoor shows up as x.cpe in some builds and com.oemservice in others: those are two names for the same preload, not two separate apps. An older loader package was com.abc.nexus. Seeing any one of those is enough to treat the device as compromised. Do not try to uninstall your way out: Google says a removed x.cpe reinstalls from the /oem/ partition after a reboot, and TrendAI says the implant is system-signed. Not finding those names does not clear the device. Google says newer variants dropped com.abc.nexus and use droppers disguised as Android system apps, with published examples such as com.android.system.ntp and com.android.sso.auth.handler. Those are examples, not a complete list.
3. Check Google Play Protect. Google says the backdoor disables Play Protect app verification. If Play Protect scanning is off and you never turned it off, treat that as a red flag. Turn scanning back on if the UI lets you.
4. Watch router data use. Open your router’s app or admin page. Heavy traffic from the device when nobody is using it is a reason to investigate further.
5. Prefer known streaming devices for new buys. For a replacement, stick to brands with a clear update path and Google certification you can verify. Avoid no-name “Android TV box” deals that never publish security notes.

If the box is a carrier-provided set-top that you rent, call the provider and ask whether your model is affected and what they recommend. Do not flash random “XCPE cleaner” firmware from a forum.

What the takedown does and does not do

Does

• Take down Videostrong control domains and servers Google targeted
• Disrupt many affiliate module C2 domains
• Ban Videostrong (and future subsidiaries or affiliates) from certified Android devices and from supplying software to other certified vendors

Does not

• Guarantee every infected box is now clean
• Remove system apps you cannot uninstall
• Replace a device that still has inert malware modules sitting on disk

Ars Technica summarizes the practical leftover risk: Play Protect may still be disabled, and modules can remain installed even when remote control is cut. Treat a confirmed match as a reason to replace the box, not as a reason to keep using it because “Google fixed the internet.”

Do this / don’t do that

Do

• Check brand, model, system apps, and Play Protect on every Android TV box, and on any other Android gadget in the house that matches Google’s or TrendAI’s device classes.
• Replace a box that shows the known packages or that you cannot trust.
• Keep the replacement on a guest or IoT Wi-Fi SSID when your router offers one, so a bad streaming gadget is less able to poke at your phones and PCs. See our guest and IoT Wi-Fi at home guide if you need the short version.

Don’t

• Do not assume “Google certified” always meant “already clean.” Google says Videostrong used obfuscation to slip past earlier checks.
• Do not leave Play Protect off “to install APKs faster.”
• Do not buy the cheapest unbranded Android TV stick because a marketplace listing promises free movies.

Bottom line

Google’s November 2, 2026 write-up of the XCPE botnet describes a Videostrong-operated backdoor on more than 1.3 million devices, mostly Android set-top boxes, with other Android gadgets in the mix (Google Threat Intelligence). The malware arrived in firmware, not as a pop-up you clicked. On your own gear: check model and system apps, restore Play Protect if you can, watch odd network use, and replace a device you cannot trust. Streaming should not quietly rent out your home internet.

Image: Official Google Threat Intelligence banner from the Google Cloud blog.