Google says Shenzhen device maker Videostrong built the XCPE backdoor into certified Android TV and Google TV boxes and rented the devices out to criminals as residential proxies. Google, Japan's National Police Agency and five security firms took down the control servers and banned Videostrong from certified Android.
If a cheap Android TV or Google TV box sits on the same home network as your work laptop, find out who made it. Google says a manufacturer, Videostrong Technology of Shenzhen, built a backdoor called XCPE into its boxes’ firmware and sold access to more than 1.3 million of them. Google has taken down the servers that controlled them and banned the company from certified Android. No model list has been published, so the safe move for an off-brand box is to unplug it.
What Google says happened
Google’s Threat Intelligence Group laid out the case in a report published November 2. It assesses “with high confidence” that Videostrong, an Android device maker that also builds hardware for other brands, developed and ran the backdoor for profit. Per Google:
- XCPE enrolled more than 1.3 million set-top boxes into a botnet. The malware has been evolving since at least late 2024.
- The boxes were certified Android TV and Google TV devices. Videostrong passed Google’s checks by loading the malicious code after first boot, a gap Google says it has now closed.
- Last week Google took legal action to seize Videostrong’s domains and servers, plus the control domains used by more than a dozen malware families its affiliates installed. Google estimates that cuts criminals off from at least 10 million more infected devices beyond XCPE.
- Videostrong and any future subsidiaries are banned from building certified Android devices or supplying software to certified vendors. Google called a manufacturer “intentionally infecting their users with malware” an “unacceptable breach of trust.”
The takedown was a joint operation. Japan’s National Police Agency worked with Google, Lumen, HUMAN Security, Plume, Synthient and TrendAI, according to The Register and The Hacker News. Videostrong did not respond to The Register.
What the boxes were doing on your network
The main business was residential proxying: criminals paid to route their traffic through a household’s internet connection so it looked like an ordinary home user. Per The Hacker News, some modules also faked ad views, and others could take screenshots, capture keystrokes, copy account details and open a remote command line.
Most infections were outside North America. The Hacker News reports roughly 26,000 to 42,000 infected devices each in the US and Canada, with the largest counts in Southeast Asia, Latin America and the Middle East. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1.
What to do with a box you already own
- Check the brand. Boxes from Nvidia (Shield), Google, Amazon, Roku, Apple and the big TV makers are not named in any of the reporting. Off-brand boxes bought on marketplaces are the risk. 9to5Google reports that Synthient’s list of likely affected devices centers on the Mecool brand.
- Don’t count on the takedown or a reset. 9to5Google reads Google’s action as leaving affected boxes safe to use for now. Synthient’s advice, per The Hacker News, is to throw them away. Plume suggests a factory reset but does not say it removes the backdoor, because the code lives in the firmware.
- Keep work gear off the same network. If you keep a box you can’t vouch for, put it on your router’s guest network. That is also the right home for smart plugs, cameras and other gear you don’t control.
- Buy from the list. Google’s certified partners list shows which brands ship approved Android TV devices. Certification alone did not catch Videostrong, so stick to brands with a track record of updates.
The home network is now part of the attack surface
Cheap TV boxes have now been turned into a criminal network at least twice in two years. The Register links XCPE to the same ecosystem as BadBox 2.0, a botnet of more than 10 million devices that was disrupted in March 2025. For a remote team, the cost lands in two places. A hijacked box can make your home IP look like a source of fraud, which gets you flagged by banks and SaaS logins. And a box that can open a remote shell sits one hop from the laptop that holds your company’s credentials. TrendAI’s advice for companies, per The Hacker News, is to treat unmanaged consumer devices on employees’ home networks as part of the attack surface. An unbranded streaming box is not worth that risk.