Overview
Google announced on November 2, 2026 that it dismantled XCPE (also written X.CPE), a backdoor and botnet spanning more than 1.3 million Android set-top boxes and other devices. The Google Threat Intelligence Group attributes the operation with high confidence to Videostrong Technology, the Shenzhen-based manufacturer behind many of the boxes, including the Mecool brand. Coverage includes SecurityWeek, Help Net Security and Dark Reading.
How It Worked
Videostrong is alleged to have monetized the backdoor by selling access to criminal affiliates and loading their malware modules onto infected devices. Uses included residential proxy services, advertising fraud and malware distribution. Google says the company used obfuscation and delayed loading of malicious code until after first boot to evade certification checks.
Google's Response
- Legal action to take down the botnet's domains and servers, and the command-and-control domains for the additional modules
- Cut ties with Videostrong and banned it, plus future subsidiaries and affiliates, from producing certified Android devices
- Changed its review process and is improving firmware checks on certified Android TV devices
Scale
Most infections were TV boxes, but researchers also found compromised telehealth equipment, karaoke machines and digital signage. Synthient estimates about 500,000 compromised devices were actively online, concentrated in Malaysia, Mexico and Brazil. Because module operators spread malware beyond XCPE, the takedown likely cut access to at least 10 million other devices.
Recommendations
- Avoid low-cost Android TV boxes from unvetted brands, and prefer Google-certified devices from known vendors.
- Place IoT and media devices on an isolated VLAN with restricted outbound access.
- Watch for unexpected outbound proxy-like traffic from set-top boxes.
- Replace devices that show unexplained network activity or lack firmware updates.