Google and its partners have disrupted XCPE, a network of devices controlled remotely without their owners’ permission. The botnet enrolled more than 1.3 million TV set-top boxes on Google’s count. Google, Japan’s National Police Agency and several security companies announced the takedown on 2nd November 2026.
Google’s security researchers say they are highly confident that Videostrong Technology, a Chinese company that designs and manufactures Android devices for other brands, deliberately built and operated the backdoor for profit. Google found the backdoor across several brands and models over a period of years. It gave operators hidden access from inside the firmware, the built-in software that runs the box.
The brand on a box can differ from the name of the company that made it. When we reviewed Safaricom’s Big Box 2, we explained the difference between Google’s Android TV platform and the wider market of boxes that run versions of Android. Google says Videostrong hid the code so it could evade certification checks and load after the box first started up. Google has since changed those checks and barred Videostrong from making certified Android devices or supplying software to other certified vendors.
What the boxes were doing
Google says Videostrong sold access to infected devices to criminal groups that could install their own software. Some of that software generated fake ad views. Other programs turned the boxes into residential proxies. They routed other people’s internet traffic through the owner’s home connection, so it could look to a website as if the traffic came from the household. The owner could be watching TV the whole time. Google also observed operators taking screenshots and extracting account information from devices.
Google and its partners targeted the servers that controlled XCPE and the domains some criminal groups used to control their own malware. Those groups also spread their software through other channels, so Google estimates the action against their domains will cut off access to at least 10 million additional compromised devices.
What owners can check
Synthient, one of the security firms involved, found the backdoor already installed on a MECOOL KM9PRO Max it bought. If you’re checking a box, start with the exact model on its label and compare it with Synthient’s list of models seen in the campaign. The list identifies models seen in the campaign. If yours is on it, check the unit and its software version to find out whether it’s affected. The published findings give no count or model list specific to Kenya.
Keep a confirmed infected box offline. Disconnect it from Wi-Fi or unplug its Ethernet cable. Google found that the firmware can hold a copy of the backdoor and reinstall it when the box restarts, even after you delete the app. Ask the seller or manufacturer whether there is verified clean firmware for your exact model before putting it back online. Synthient advises consumers with affected devices to retire them.
Join the discussion