Google and partners shut a botnet hidden in 1.3 million Android TV boxes

That cheap streaming box under the TV may have been working for someone else. More than 1.3 million Android TV boxes shipped with a backdoor that let criminals use them, and thousands were in Australia.

Google says it and industry partners have now dismantled the backdoor, called XCPE. Its threat intelligence team published the details on 2 November.

The backdoor came from the factory

This wasn’t an app someone downloaded. Google says it has “high confidence” that the backdoor was built, deployed and run for profit by Videostrong Technology. Videostrong is an Android device maker that also builds devices for other brands.

The code turned up in many models and brands over several years. Google believes this wasn’t a rogue insider or an oversight.

The company sold access to the boxes to criminal “affiliates” and loaded their software onto them. That software ran ad fraud, loaded more malware and quietly turned households into proxy servers.

Your internet connection, rented out

A residential proxy lets someone send their internet traffic through your home connection. To a bank or online shop, it looks like it’s coming from an ordinary household.

TrendAI, one of the security firms involved, says that’s the point. Traffic from a real home address passes the checks that banks, retailers and online services rely on. So criminals can look like local customers.

The operators could do more than borrow bandwidth. Google saw them take live screenshots, inject keystrokes and pull account and device information off boxes. TrendAI says the boxes also collected details of nearby Wi-Fi networks and Bluetooth settings.

How many in Australia

TrendAI counted 1,472,554 infected devices across 206 models in more than 170 countries, between June and October 2026. Most were TV set-top boxes, along with projectors and other Android devices.

Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The US, Germany, the UK, Australia and Canada each had about 26,000 to 42,000.

Cut off, but not cleaned up

Google says it took legal action to take down the servers Videostrong used to control the boxes. It also went after the servers behind more than a dozen malware families loaded through the backdoor. It expects that to cut off at least 10 million more infected devices.

Google has also banned Videostrong, and any future subsidiaries or affiliates, from making certified Android devices or supplying software to certified makers.

The catch is that the code is still on the boxes. TrendAI says owners can’t remove it themselves, because it runs as a system app signed by the manufacturer. Cleanup needs the maker, platform protection or a replacement device.

Which boxes are affected

There’s no simple list to check. Researchers at Synthient published 182 model names seen in the campaign, many of them generic, such as “4K_Android_TV_Box”. They warn that a model name alone doesn’t confirm a box is infected.

Synthient’s test device was a MECOOL box (KM9PRO). Google says Videostrong’s code turned up across many brands, so the brand on the box doesn’t settle it.

Play Protect certification is worth checking, but it isn’t a guarantee here. Google says Videostrong hid its code to slip past Google’s own tests, loading it after the device was first switched on. The backdoor also switched off Google Play Protect’s app checks. Google has since changed its review process.

Not just a lounge-room problem

TrendAI warns that if an infected device sits on a work network, the attacker could reach the rest of that network. It says businesses should treat unmanaged devices on staff home networks as a risk, and keep work systems behind devices the business manages.

That applies to the shop too. A cheap Android box driving the menu screen or the TV in the waiting room is on your network.

Google’s advice: buy set-top boxes only from reputable manufacturers. Be “extremely wary” of apps that pay you for “unused bandwidth”. If you’re weighing up other Android app sources, see our story on rival Android app stores getting one-tap installs.

Checklist

• Find every Android TV box, stick and projector in the house or business. Include menu screens, waiting-room TVs and anything plugged into a TV that came cheap or unbranded.
• Check whether each one is Play Protect certified. In the Play Store app, tap your profile icon, then Settings, then About.
• Replace any box that is unbranded, uncertified or on Synthient’s published model list. Owners can’t remove this backdoor themselves, so a new device from a reputable maker is the reliable fix.
• Delete apps that pay you for “unused bandwidth” or “sharing your internet”. Google says these are a main way illicit proxy networks grow.
• Keep Google Play Protect switched on. Check it’s active on any Android device you keep.
• Keep work logins off TV boxes and other unmanaged devices. Use devices the business manages for work systems, including at home.