NewsCompaniesFlawsGuides
Get the app
HighNo fix yetUpdated

Google disrupts XCPE botnet in 1.3 million Android TV boxes; backdoor remains

Google disrupted a botnet in more than 1.3 million Android TV boxes, but infected devices remain backdoored. Videostrong and MECOOL owners should check with their seller, disconnect suspected boxes and seek a replacement or verified clean firmware.

What to do

Ask your seller whether your Videostrong-built or MECOOL TV box is implicated in XCPE; a model name alone cannot confirm infection. Disconnect a suspected box from power and the internet, and ask for a replacement or verified clean firmware. Do not treat uninstalling an app or the botnet takedown as proof that the box is safe.

Check your devices
  • MECOOL KM9PRO Max firmwareno fixed version yet

What’s happening

Google says Videostrong deliberately embedded the XCPE backdoor in device firmware and sold criminals access to infected devices. More than 1.3 million set-top boxes joined the botnet, which enabled advertising fraud, additional malware and routing strangers’ traffic through household internet connections. Google also observed operators taking screenshots and extracting account information. Most infected devices were Android TV boxes; Synthient confirmed a preinstalled backdoor on a MECOOL KM9PRO Max. Google and partners disrupted control infrastructure in late October, but this did not clean infected boxes. Removing the backdoor app does not last: it reinstalls when the device restarts. Google has not published a complete affected-model list, and the sources checked identify no released clean firmware version as of 3 November. Owners should disconnect suspected devices and arrange replacement or verified remediation.

What
Poisoned software
Affects
Videostrong-built Android TV boxes, including an infected MECOOL KM9PRO Max
Affected
Videostrong-built devices containing the XCPE firmware backdoor, named x.cpe or com.oemservice; Google does not provide a complete model or firmware-version list.
Google identifies mainly Android TV set-top boxes, plus some Android-based telehealth devices, karaoke machines and digital signage.
MECOOL KM9PRO Max: Synthient confirmed the backdoor preinstalled on its purchased device; affected firmware versions are unspecified.
Fixed in
No fix yet
Since
2 Nov 2026

Timeline

  1. Update

    Malwarebytes warned that the takedown had not removed the backdoor and advised owners to disconnect suspected boxes and request clean firmware or a replacement. It noted that Google had not published a complete affected-model list.

  2. Update

    Takedown partner Synthient reported finding the backdoor preinstalled on a MECOOL KM9PRO Max purchased in late 2025. It recommended permanently disposing of implicated devices because they could contain additional malware.

  3. Made publicNo fix yet

    Google disclosed that it and partners had disrupted the XCPE botnet the previous week, affecting more than 1.3 million set-top boxes. It attributed the deliberately installed backdoor to Videostrong with high confidence and banned the company from supplying certified Android devices or software.

Sources

  1. Shutting the Door on the XCPE BotnetGoogle Threat Intelligence Group · 2 Nov 2026
  2. The Internals of a Badbox OperationSynthient · 2 Nov 2026
  3. Google disrupts million-device XCPE Android malware botnet, bans TV box makerBleepingComputer · 2 Nov 2026
  4. Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal AccessThe Hacker News · 2 Nov 2026
  5. A hidden backdoor put 1.3 million TV boxes to work for criminalsMalwarebytes · 3 Nov 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from November 2026 · JSON · RSS