{"id":"videostrong-xcpe-tv-box-backdoor-nov-2026","category":"supply-chain","status":"live","title":"Google disrupts XCPE botnet in 1.3 million Android TV boxes; backdoor remains","tldr":"Google disrupted a botnet in more than 1.3 million Android TV boxes, but infected devices remain backdoored. Videostrong and MECOOL owners should check with their seller, disconnect suspected boxes and seek a replacement or verified clean firmware.","summary":"Google says Videostrong deliberately embedded the XCPE backdoor in device firmware and sold criminals access to infected devices. More than 1.3 million set-top boxes joined the botnet, which enabled advertising fraud, additional malware and routing strangers’ traffic through household internet connections. Google also observed operators taking screenshots and extracting account information. Most infected devices were Android TV boxes; Synthient confirmed a preinstalled backdoor on a MECOOL KM9PRO Max. Google and partners disrupted control infrastructure in late October, but this did not clean infected boxes. Removing the backdoor app does not last: it reinstalls when the device restarts. Google has not published a complete affected-model list, and the sources checked identify no released clean firmware version as of 3 November. Owners should disconnect suspected devices and arrange replacement or verified remediation.","action":"Ask your seller whether your Videostrong-built or MECOOL TV box is implicated in XCPE; a model name alone cannot confirm infection. Disconnect a suspected box from power and the internet, and ask for a replacement or verified clean firmware. Do not treat uninstalling an app or the botnet takedown as proof that the box is safe.","product":"Videostrong-built Android TV boxes, including an infected MECOOL KM9PRO Max","audience":"home","severity":"high","patch":"none","exploited":true,"cves":[],"tags":["videostrong","mecool","android","android-tv","xcpe","botnet","backdoor","supply-chain"],"affected":["Videostrong-built devices containing the XCPE firmware backdoor, named x.cpe or com.oemservice; Google does not provide a complete model or firmware-version list.","Google identifies mainly Android TV set-top boxes, plus some Android-based telehealth devices, karaoke machines and digital signage.","MECOOL KM9PRO Max: Synthient confirmed the backdoor preinstalled on its purchased device; affected firmware versions are unspecified."],"fixed":[],"matches":[{"platform":"android","app":"MECOOL KM9PRO Max firmware","bundle":"","fixed":""}],"sources":[{"kind":"advisory","title":"Shutting the Door on the XCPE Botnet","url":"https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/","by":"Google Threat Intelligence Group","date":"2026-11-02"},{"kind":"research","title":"The Internals of a Badbox Operation","url":"https://synthient.com/blog/the-internals-of-a-badbox-operation","by":"Synthient","date":"2026-11-02"},{"kind":"news","title":"Google disrupts million-device XCPE Android malware botnet, bans TV box maker","url":"https://www.bleepingcomputer.com/news/security/google-disrupts-million-device-xcpe-android-malware-botnet-bans-tv-box-maker/","by":"BleepingComputer","date":"2026-11-02"},{"kind":"news","title":"Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access","url":"https://thehackernews.com/2026/11/google-disrupts-13-million-device.html","by":"The Hacker News","date":"2026-11-02"},{"kind":"research","title":"A hidden backdoor put 1.3 million TV boxes to work for criminals","url":"https://www.malwarebytes.com/blog/mobile/2026/11/a-hidden-backdoor-put-1-3-million-tv-boxes-to-work-for-criminals","by":"Malwarebytes","date":"2026-11-03"}],"started":"2026-11-02","closed":null,"created":"2026-11-03T18:55:36.478Z","updated":"2026-11-03T18:55:36.478Z","cve_notes":[],"timeline":[{"at":"2026-11-03","added":"2026-11-03T18:54:07.992Z","kind":"other","text":"Malwarebytes warned that the takedown had not removed the backdoor and advised owners to disconnect suspected boxes and request clean firmware or a replacement. It noted that Google had not published a complete affected-model list.","url":"https://www.malwarebytes.com/blog/mobile/2026/11/a-hidden-backdoor-put-1-3-million-tv-boxes-to-work-for-criminals","by":"Malwarebytes","patch":null},{"at":"2026-11-02","added":"2026-11-03T18:54:07.992Z","kind":"other","text":"Takedown partner Synthient reported finding the backdoor preinstalled on a MECOOL KM9PRO Max purchased in late 2025. It recommended permanently disposing of implicated devices because they could contain additional malware.","url":"https://synthient.com/blog/the-internals-of-a-badbox-operation","by":"Synthient","patch":null},{"at":"2026-11-02","added":"2026-11-03T18:54:07.992Z","kind":"disclosed","text":"Google disclosed that it and partners had disrupted the XCPE botnet the previous week, affecting more than 1.3 million set-top boxes. It attributed the deliberately installed backdoor to Videostrong with high confidence and banned the company from supplying certified Android devices or software.","url":"https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/","by":"Google Threat Intelligence Group","patch":"none"}],"url":"https://hard.fyi/live/videostrong-xcpe-tv-box-backdoor-nov-2026/","json":"https://hard.fyi/api/live?id=videostrong-xcpe-tv-box-backdoor-nov-2026"}