Google just shut down an Android TV box backdoor that sat inside the firmware of more than 1.3 million streaming boxes. If you own a cheap, no-name Android TV or Google TV box, especially a MECOOL, your box may have been secretly renting out your internet connection.
Quick facts
- The malware is called XCPE (also written x.cpe). Google announced the takedown on November 2, 2026.
- It was built into the firmware by the maker, Videostrong, so you can’t uninstall it.
- Google says its action cuts off at least 10 million more compromised devices.
- Videostrong is now banned from making or selling certified Android devices.
The takedown cuts off the criminals, but it doesn’t clean your box. That’s the part worth understanding.
What the Android TV box backdoor actually did
XCPE ran as a system app with the highest privileges on the box. According to Google’s threat intelligence team, it reinstalled itself after a reboot even if you removed it, and it switched off Google Play Protect so other apps could install silently.
From there, operators could take screenshots, send keystrokes, open remote shells and map your home network. Most of the time, though, they wanted something simpler: your bandwidth.
Infected boxes were turned into residential proxies, so strangers’ traffic looked like it came from your house. Others were used for ad fraud, loading hidden ads nobody ever saw.
Here’s why that matters. Traffic routed through your connection can carry scams or attacks, and it may point back at your IP address, not theirs.
Which boxes are affected?
Google’s post doesn’t name specific brands. Researchers did. Synthient focused on MECOOL-branded boxes and published a list of 182 model names, and The Hacker News reports most infected units found by Plume were MECOOL. Videostrong also builds devices for other brands.
The scale and scope, according to the reports:
| Item | What’s reported |
|---|---|
| Confirmed infected set-top boxes | 1.3 million+ (Google) |
| TrendAI count, June 3 to October 1, 2026 | 1,472,554 devices across 206 models |
| Extra devices cut off by the takedown | At least 10 million (Google) |
| Other device types hit | Telehealth devices, karaoke machines, digital signage |
A model match on the Synthient list doesn’t prove your box is infected. It does mean you should treat it with suspicion.
How Google shut it down
Google took legal action to seize the domains and servers that controlled the botnet. It also went after control domains for more than a dozen malware families loaded through the backdoor, working with Japan’s National Police Agency and security firms including Lumen, HUMAN Security, Plume, Synthient and TrendAI.
Google says it assesses with high confidence that Videostrong built the backdoor on purpose and sold access to criminal affiliates. It also found the company hid code to get past Google’s compatibility tests, so Google is changing its certification review and firmware integrity checks.
The same report warns the market is resilient. Operators tend to pivot quickly to new loaders and software kits, and new dropper packages appeared as recently as August 2026.
How to check your box and what to do next
Start with the model name, usually on the sticker underneath. Compare it with Synthient’s list. Then look at what the box is doing.
These signs suggest something is wrong:
- Apps you never installed, especially ones that mention “sharing bandwidth” or “passive income.”
- Play Protect turned off and refusing to stay on.
- Constant network activity while the box sits idle on the home screen.
None of these is proof, but together they’re a strong hint.
If your box is on the list, the safest move is replacing it. According to The Hacker News, Synthient advises consumers to discard the boxes, and Plume recommends a full factory reset, though the report doesn’t confirm a reset removes the malware. Since XCPE reinstalls from the firmware, I wouldn’t count on it.
Until you replace it, unplug the box or move it to a guest network away from your phones and laptops. When you shop for the next one, use Google’s Android TV partner list. For more on keeping your Android devices current, see our guide to the Android November 2026 security update, and our piece on protecting yourself from infostealers.
Frequently Asked Questions
Is my Android TV box safe now that Google shut down the botnet?
Safer, but not clean. Google says the takedown cuts off the control servers, so criminals can’t easily send commands. The malware itself is still in the firmware of affected boxes.
Does a factory reset remove the XCPE backdoor?
Probably not. XCPE lives in the firmware and reinstalls after a reboot, per Google. Plume suggests a reset, but that isn’t confirmed as a fix.
Are Chromecast, Fire TV or Apple TV affected?
The reports don’t mention them. The problem centers on uncertified or lesser-known Android boxes, mostly MECOOL-branded, built by Videostrong.
Should I keep using an affected box?
I wouldn’t. The cost of a replacement is small next to having an unknown party inside your home network.
Keep it or bin it? My call
If your box is a cheap one from an unfamiliar brand and it’s on Synthient’s list, replace it this week. A certified streaming stick from a major brand costs about the same as a takeout dinner, and it won’t quietly sell your connection to strangers. If your box is from a mainstream brand and not on the list, you can relax, but keep Play Protect on and be wary of any app that offers to pay you for “unused bandwidth.”
Leave a Reply