Google shuts down a botnet built into 1.3 million Android TV boxes, but the backdoor stays on them
Google says it is highly confident Videostrong deliberately built the XCPE backdoor into devices and sold access to criminals. They used infected boxes for advertising fraud and to route other people's traffic through owners' home connections. Google and partners disrupted the botnet in late October, but the backdoor remains in the devices' built-in software.
Google has disrupted a botnet involving more than 1.3 million devices, mostly Android TV boxes. Owners of Videostrong-made and MECOOL boxes still need to check theirs: the takedown leaves the malware installed.
What happened
Check the streaming box plugged into your television, including the one you set up for your parents. This week Google said it and its partners had disrupted a network of more than 1.3 million compromised devices, mostly Android TV boxes. Infected boxes secretly passed strangers' internet traffic through their owners' connections and generated fake advertising activity, as Krebs on Security reports[1].
Google's assessment[2] is that the manufacturer, Videostrong Technology, deliberately developed and operated the backdoor for profit, selling access to criminal customers. It says it has high confidence in that conclusion and does not believe a rogue employee or development mistake explains it.
- HARD level
- High Persistent malware on household devices
- Scale
- More than 1.3 million devices; predominantly Android TV boxes
- Confirmed example
- A MECOOL KM9PRO Max examined by Synthient
- After the takedown
- The backdoor remains on infected boxes
Timeline
-
HARD publishes its article, at High.
Who is affected
Start with boxes made by Videostrong, including devices sold under other brands. Security firm Synthient bought a MECOOL KM9PRO Max[3] and found the backdoor already installed.
Synthient's published model list includes KM9PRO_MAX, KM2PLUSDELUXE and KT1, among many others. These are names reported by devices seen in the campaign. Synthient explicitly warns that a model name alone cannot confirm an infection. A match is a reason to investigate your particular box.
TrendAI counted 1,472,554 infected devices across 206 models[4] between June and October 2026, including infections in Australia. It explains that partners' totals differ because their observation periods and visibility differ.
What the box was doing
A residential proxy lets someone else's internet traffic leave through your home connection. To the website receiving it, the connection appears to belong to an ordinary household. Owners had not agreed to this use of their boxes. Other software on the devices faked advertising views and clicks, according to The Hacker News[5].
The access went further than bandwidth. Google observed operators taking screenshots, sending keystrokes and extracting account information from devices. That makes accounts used on an affected box worth reviewing too.
What the takedown changes
The operation targeted the servers and internet addresses used to control the malware. It also targeted related malware families: Google expects that wider action to sever access to at least 10 million additional compromised devices infected through other routes, The Register reports[6]. That is an estimate of the wider disruption, not another count of Videostrong boxes.
Google has banned Videostrong and future subsidiaries or affiliates from making certified Android devices or supplying software to certified manufacturers. It has also changed its security review process after finding that Videostrong evaded its tests.
For an owner, the unresolved problem is inside the box. Uninstalling the backdoor does not keep it off[7]: it reinstalls from the built-in software when the device restarts. TrendAI says owners cannot remove the implant themselves. We could not verify a firmware fix for owners as of 4 November.
What to do this week
- Unplug a suspect box.Disconnect its power while you investigate. Check the boxes in your parents' home as well as your own.
- Identify the exact device.Use its label, packaging and order history to record the brand and model. Compare them with Synthient's list and ask the seller who made it. A matching name needs investigation; it does not prove infection.
- Replace a confirmed infected box.Synthient recommends permanently disposing of affected devices. HARD recommends replacement from a different, reputable manufacturer. Do not treat a factory reset or an ordinary software update as proof that the backdoor is gone. Ask the seller about a remedy or replacement[8].
- Review accounts used on the box.As a precaution, use a trusted phone or computer to review sign-in activity, end unfamiliar sessions and change passwords for accounts used on a confirmed infected device. Google's observation of account-data theft does not establish that every owner's accounts were taken over.
Related
Situations
- NIKKE PC launcher hacked to spread password-stealing malware; official security check released Malware, high, 6 Nov 2026
- Apple brings its fix for an exploited flaw to the iPhone XS, XS Max, XR and seventh-generation iPad Software flaw, high, 4 Nov 2026
- Harvard alumni and donor data breach: 851,000 email addresses, with birth dates, phone numbers and donations Data breach, watch, 3 Nov 2026
- mSecure warns of suspicious activity and tells customers to replace saved passwords and passkeys Other, high, 4 Nov 2026
- Every situation, in the Situation Room
Companies
References
- ^ Krebs on Security (). “Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies”. Explains household connection resale and advertising fraud; displayed date differs from the brief.
- ^ Google Threat Intelligence Group (). “Shutting the Door on the XCPE Botnet”. Primary attribution, observed capabilities, disruption, manufacturer ban and certification changes.
- ^ Synthient (). “The Internals of a Badbox Operation”. MECOOL KM9PRO Max examination and recommendations to disconnect and dispose of affected devices.
- ^ TrendAI (). “TrendAI Research Helps Disrupt Botnet of More Than 1.3 Million Pre-Infected Set-Top Boxes”. Device counts, Australian infections, measurement differences and persistent implant.
- ^ The Hacker News (). “Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access”. Reports late-October timing, proxy activity and differing clean-up advice.
- ^ The Register (). “Cops bust botnet of 1.3M infected Android TV boxes”. Corroborates infrastructure disruption and distinguishes the additional-device estimate.
- ^ BleepingComputer (). “Google disrupts million-device XCPE Android malware botnet, bans TV box maker”. Corroborates the operation and explains why uninstalling the malware does not remove the infection.
- ^ Malwarebytes (). “A hidden backdoor put 1.3 million TV boxes to work for criminals”. Advises disconnection and contacting sellers about clean firmware or replacement.
- Synthient. “Videostrong research: device specifications and backdoored device models”. Observed model strings and explicit warning that model names alone cannot confirm compromise.
- Ars Technica (). “Google dismantles botnet secretly running on 1.3 million Android TV boxes”. Read for comparison; its reassurance about continued use conflicts with more cautious primary guidance.
- Videostrong. “Help Center”. Checked manufacturer support information; no XCPE-specific verified fix identified.
- MECOOL. “News”. Checked advertised firmware updates; these do not establish XCPE remediation.
Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.