NewsCompaniesFlawsGuides
Get the app

The TV box botnets: why cheap streaming boxes come pre-infected

A long read from HARD News · · 7 min read

Three times in two years, investigators have found cheap Android streaming boxes sold with criminals’ software already inside, by the million. How the scheme works, why taking it down doesn’t clean the boxes, and how to check the one under your television.

The cheapest way to put streaming apps on a television is a small Android box that plugs into the back of it. Millions of them have been sold with someone else’s software already inside. Out of the box, they quietly rent the household’s internet connection to strangers, fake advertising clicks and take instructions from servers their owners have never heard of.

It has happened three times in two years: BADBOX, then BADBOX 2.0, and in October 2026 a botnet called XCPE, which Google says ran on more than 1.3 million boxes and was built into them by the company that made them.[1] Each was taken down. None of the takedowns cleaned the boxes, and that is why this is worth understanding.

What happened, and when

WhenWhat happened
December 2024Germany’s cybersecurity agency, the BSI, cuts the original BADBOX off from its operators. It counts at least 30,000 devices sold in Germany with the malware already installed, all running outdated versions of Android, and tells owners to disconnect them.[6]
5 June 2025The FBI warns about BADBOX 2.0: millions of infected streaming boxes, projectors, car entertainment systems and digital picture frames, most of them made in China. Some arrive infected; others are infected during setup by the apps they tell you to install.[4]
July 2025Google sues 25 unnamed people in China, saying BADBOX 2.0 had infected more than ten million devices by April 2025, with backdoors installed before sale.[5]
June to October 2026Security firm TrendAI counts 1,472,554 boxes infected with a backdoor called XCPE, across 206 models in more than 170 countries. Australia is among the countries with tens of thousands of them, alongside the United States, Germany, the United Kingdom and Canada.[2]
Late October 2026Google and its partners take down XCPE’s servers. Google says it has high confidence the backdoor was built and run for profit by Videostrong Technology, the company that made the boxes, and bans it from certified Android devices.[1]

How a box ends up working for someone else

The main business is the internet connection. An infected box becomes a residential proxy: other people’s traffic leaves through your home, so to the website on the other end it looks like it comes from an ordinary household. That disguise is worth paying for. The people who rent it use it for taking over accounts, for advertising fraud and for scraping websites in bulk.[3] The owner is never asked and never paid.

The boxes also click on adverts nobody sees. And the people running XCPE could do more than borrow bandwidth: Google saw them take live screenshots, type on the box remotely, copy account and device information off it, and run commands of their choosing.[1] A box like that is a computer in your living room that answers to someone else.

A takedown cuts the box off from its operators. It doesn’t take the software out of the box.

Why taking it down doesn’t clean the boxes

The software isn’t an app someone downloaded by mistake. It is part of the box’s own system. Google says XCPE can’t be removed by the owner, and that if it is uninstalled it puts itself back the next time the box restarts.[1] TrendAI says the same: owners cannot remove it themselves, and cleaning it up takes the maker, Google’s protections or a new box.[2]

A takedown goes after the servers that send the boxes their instructions. That stops the current operators, and Google expects its action to cut off at least 10 million more devices infected by related schemes.[1] But the boxes still carry the software that made them useful, on old versions of Android that rarely get updates. The pattern so far is that the boxes outlive the schemes, and the next scheme finds them.

Price is the other reason. These boxes are sold as cheaper alternatives to the big brands, often as “unlocked” or with free television on offer,[4] and many are built from Android’s open-source code rather than Google’s certified version.[5] Google says only Play Protect certified devices may carry its apps, and that uncertified ones may not be secure or receive updates.[7] XCPE showed certification isn’t a guarantee either: Google says the maker slipped past its checks, and it has changed its review process since.[1]

How to tell whether yours is one of them

The FBI’s warning signs are the practical test: a brand you don’t recognise, a box sold as unlocked or with free content, setup that asks you to turn off Google Play Protect or install apps from outside the Play Store, and a device that isn’t Play Protect certified. It adds that any one of these on its own doesn’t prove anything.[4]

To check certification, open the Play Store on the box, choose your profile picture, then Settings, then About. It says whether the device is Play Protect certified.[7] Synthient, one of the firms behind the XCPE takedown, has published the model names it saw in the campaign. A match is a reason to look closer, not proof.[8]

What to do this week

  1. Check every streaming box in the house, and at your parents’. Note the brand and model of each box plugged into a television or projector, and check its Play Protect certification in the Play Store’s settings. Pay most attention to anything bought online for less than the big brands charge, or set up for someone as “free TV”.
  2. Unplug anything that fails the checks. A box from a brand you can’t place, without certification, or that needed Play Protect turned off to work, should come off the network while you decide. Taking the power out is enough.
  3. Replace it rather than reset it. A factory reset doesn’t remove software built into the system, and the box will reinstall it. Use the apps built into the television, or a streaming device from a major brand bought through a mainstream shop.
  4. Say no to apps that pay for your connection. Google warns against apps offering money for “unused bandwidth” or for sharing your internet: they turn your home into the same kind of proxy, with your agreement.[1]
  5. Change the passwords you typed into a suspect box. Streaming services, YouTube, the Google account it signed in with. Do it from a phone or computer you trust, not from the box.
  6. Tell the people it also affects. These boxes are often a gift, or set up by a relative for a grandparent. Ask who else in the family has one.

For the takedown itself, and what is known about the affected models, see HARD’s alert on the XCPE botnet. Going through every device in a household, and which of them answer to someone else, is the kind of quiet work private cybersecurity is for. Harden your home covers the rest of the network.

See also

References

  1. ^ Google Threat Intelligence Group. “Shutting the Door on the XCPE Botnet”, Nov 2026.The XCPE takedown: more than 1.3 million boxes, Videostrong’s role, what the backdoor did, how it survives removal, and Google’s ban.
  2. ^ TrendAI. “TrendAI research helps disrupt Android TV botnet of more than 1.3 million pre-infected devices”, Nov 2026.1,472,554 infected devices across 206 models in more than 170 countries between June and October 2026, Australia among them; owners cannot remove the implant.
  3. ^ Krebs on Security. “Tech firms dismantle botnet that turned 1.3M TV boxes into proxies”, Nov 2026.Who took part in the takedown, the proxy services the boxes were sold to, and what proxies like these are used for.
  4. ^ FBI. “Home internet connected devices facilitate criminal activities (I-060525-PSA)”, Jun 2025.BADBOX 2.0: the kinds of device, how they are infected, the warning signs and the FBI’s advice.
  5. ^ The Register. “Google sues 25 alleged BadBox 2.0 botnet operators, all of whom are in China”, Jul 2025.Google’s lawsuit: more than ten million devices by April 2025, the kinds of device, and backdoors preinstalled.
  6. ^ BleepingComputer. “Germany blocks BadBox malware loaded on 30,000 Android devices”, Dec 2024.Germany’s BSI sinkholes BADBOX: at least 30,000 devices sold with the malware preinstalled, all on outdated Android.
  7. ^ Google. “Check if your device is Play Protect certified”.How to check a device’s certification in the Play Store, and what Google says about uncertified devices.
  8. ^ Synthient. “Videostrong: backdoored device models”, Nov 2026.The model names seen in the XCPE campaign, with the warning that a model name alone doesn’t confirm an infection.

Sources checked 4 November 2026. The partners’ counts of the XCPE botnet differ (Google more than 1.3 million, TrendAI 1,472,554) because each saw it over a different period and from a different vantage point. Google’s attribution to Videostrong is its own high-confidence assessment; Videostrong’s response wasn’t found.