A cheap Android TV box can arrive with malware already inside, and Google now says one Chinese manufacturer did exactly that on purpose. On Monday the company announced it had broken up XCPE, a backdoor found in the firmware of more than 1.3 million set-top boxes. The criminals who were renting access to these boxes have lost their control servers. The boxes themselves have not been cleaned, so anyone who bought one still has the malware.
A backdoor that was for rent
Google’s threat intelligence report says the manufacturer, Videostrong Technology, charged other criminal groups for access. Those groups added their own code. Some of it clicked on adverts or opened hidden pages, and some of it let strangers route their internet traffic through the box owner’s connection. Operators could also run commands on a box, take screenshots, press keys and pull account details, app lists and logs, according to the report. They switched off Google Play Protect’s app verification first, so that apps could be installed without a prompt. Because the code sits in the system partition, uninstalling it does nothing. It returns at the next reboot.
Wider than one brand
The same takedown hit control servers used by more than a dozen malware families that rode in on the backdoor. They also spread by other routes, so Google puts the number of devices losing contact with their operators at 10 million or more. TV boxes dominate, but karaoke machines, digital signage and telehealth devices appear too. Security firm Synthient helped trace the code to Videostrong after finding it on a MECOOL KM9PRO Max bought in late 2025. Japan’s National Police Agency, Lumen, HUMAN Security, Plume and TrendAI also worked on the case.
The gap in Google’s checks
Android TV boxes with Google apps must pass Google’s compatibility and security tests. Videostrong disguised its code so that it loaded only after the first boot, which the tests missed. Google has revised that review and tightened firmware integrity checks. It did not say how many certified boxes were infected, and it barred Videostrong and any future affiliates from building certified devices or supplying software to certified makers. The malware has kept changing. Since late 2024 it has used a separate loader, and from August 2026 it has been replaced with droppers named to look like system apps, such as com.android.system.ntp.
If you own one
Removing the app is not enough, because it comes back from the firmware at the next reboot. The reliable fix is clean firmware from a maker you trust. Until then, unplugging the box from your network cuts it off from the operators, though it also stops the streaming apps.
