Google dismantled the XCPE botnet on November 2, 2026, disrupting a network built from more than 1.3 million Android devices, most of them TV streaming boxes. The alarming part is not just the size. Google says the backdoor was not an accident or a missed patch: its Threat Intelligence Group assesses with high confidence that Shenzhen-based manufacturer Videostrong Technology deliberately built it into device firmware, then sold access to criminal affiliates who ran their own schemes through people’s living rooms.
What XCPE Was — and Why It Matters
XCPE is the name for the backdoor, tracked as x.cpe and com.oemservice, and for the botnet it created. It was preloaded in firmware, so it arrived with the device before sale, ran with Android system privileges, and could survive ordinary app removal. Most infected devices were Android TV set-top boxes, but researchers also found it in other Android-based devices, including telehealth equipment, karaoke machines and digital signage.
BleepingComputer’s coverage also described the scale of the disruption. A separate telemetry count from partner TrendAI put infections at 1,472,554 devices across 206 models. That figure differs from Google’s 1.3 million headline count because it comes from TrendAI’s own network observations, and the two figures should not be mixed up.
How the Backdoor Worked
In plain language, the backdoor used obfuscation to slip past pre-release security checks and load malicious code after first boot. It communicated with command servers over MQTT — Google identified mqtt.szbboys[.]com on ports 3885-3887 — and it could disable Google Play Protect verification. Affiliates then used infected boxes for ad fraud, residential proxy services, data exfiltration and installing further malware. Synthient’s investigation traced the backdoor to Videostrong after finding malware preinstalled on a MECOOL KM9PRO Max box bought in late 2025.
tampered software can plant a backdoor before a device is even unboxed, and XCPE shows how a trusted-looking box can arrive already compromised.
Why the Takedown Does Not Clean Your Box
This is the most important consumer point: shutting down servers cuts criminals’ control, but the implant already inside a device does not vanish. Owners of affected boxes cannot simply rely on the takedown, and researchers have said owners cannot remove the implant themselves in the usual way. Practical advice: disconnect a suspect box from the network if you cannot verify it, do not enter passwords or payment details on it, and consider replacing an uncertified cheap box rather than trying to clean firmware you cannot trust.
What Google Did to Videostrong
Google ended its relationship with Videostrong, revoked its licence to make Android TV devices with preloaded Google apps, and banned Videostrong and its future subsidiaries and affiliates from producing certified Android devices or supplying software to certified vendors. Google also changed its device review process and improved firmware integrity checks.
Note carefully: this is Google’s assessment, corroborated by partner investigations, not a court ruling, and Videostrong did not respond to press inquiries in the reporting.
Digital Trends’ report on the takedown also covered Google’s wider action: legal action against XCPE servers and command domains of more than a dozen affiliate malware families, which Google estimates will sever criminal access to at least 10 million additional compromised devices. Those additional devices were compromised through other routes, not through XCPE itself.
AI-powered security services are becoming a core part of how large platforms defend devices at scale, and this case shows why ecosystem-level enforcement matters as much as any single device update.
How to Check Your Streaming Box
Practical checklist: (1) Buy from reputable manufacturers and check Google’s certified partner list; (2) be wary of ultra-cheap boxes from unknown brands, especially ones promising free premium content; (3) keep Play Protect enabled and use trusted app stores only; (4) avoid apps that pay you for sharing unused bandwidth; (5) keep the box’s software updated and, if anything feels off (odd ads, sluggish performance, unexplained network traffic), unplug it and replace it.
What This Means for Cheap Smart Devices
The cheapest device can carry the highest hidden cost when firmware is untrusted; certification, brand accountability and update support matter more than specs on a bargain box. That lesson links to the wider smart-home security picture, where a single weak device can expose a whole network.
smart-home security report findings show the same pattern across connected homes: convenience devices are often the easiest way in for attackers, and the risks grow as more gadgets join the network.
which smart-home devices carry the most risk is a question every buyer should ask before choosing a bargain box, especially for always-on, internet-connected gadgets with little update support.
XCPE is a reminder that a takedown is a win for the internet, not a cleanup for your living room. If your streaming box came from a brand you cannot verify, treat the takedown as the warning, not the fix.
