Hidden Backdoor Found in 1.3 Million Android TV Streaming Boxes

Google says a China-based manufacturer secretly built malicious software into more than 1.3 million Android TV streaming boxes and other devices, giving outside operators remote access to people’s home networks without their knowledge.

According to a Nov. 2 report from Google’s Threat Intelligence Group, investigators concluded with high confidence that the manufacturer, Videostrong Technology, deliberately installed a backdoor called XCPE for financial gain. Videostrong makes Android-powered devices sold under various brand names, and some of the affected products passed Google’s own security certification process before shipping.

Google says Videostrong sold access to the compromised devices to criminal affiliates, who used them to build a botnet — a network of infected devices controlled remotely without owners’ consent. Most affected devices were Android TV streaming boxes, though the operation also touched karaoke machines, digital signage equipment and some telehealth devices.

What the malware could do

One major use was routing other people’s internet traffic through victims’ home connections, a practice known as residential proxying, which can make a stranger’s online activity appear to come from your household. Google also found modules that generated fake advertising activity, along with capabilities to capture screenshots, log keystrokes and collect sensitive account information. Operators could also remotely install additional software on infected devices.

The malware was embedded in device firmware rather than installed as a separate app, meaning that removing a visible malware package did not guarantee the infection was gone — the system could reinstall it after a reboot. Google says Videostrong concealed the malicious code during certification testing, with additional malicious code loading after the device’s first startup. The backdoor could also disable Google Play Protect, one of Android’s built-in security defenses.

Which devices are affected

Google has not published a full consumer list of infected retail products. However, cybersecurity firm Synthient conducted its own investigation and found the XCPE backdoor preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025, running firmware version C1.0.8_20250325 under the package name com.oemservice.

Synthient also identified other model names observed in the broader botnet, including KM9PRO_MAX, KM9PRO, KM2PLUSDELUXE, KM2PLUS, KM7PLUS, KT1, IPx1, IPx3, Q96MAX and TX3MINI. Synthient has cautioned that matching one of these model names does not by itself confirm an individual device is infected. The list is published at github.com/synthient/public-research/blob/main/2026/11/Videostrong/README.md.

Google’s response

Google worked with Japan’s National Police Agency and several cybersecurity firms to take legal action against the domains and servers Videostrong used to control infected devices. The company also pursued legal action against command-and-control infrastructure tied to more than a dozen other malware families, action Google says is expected to cut off criminal access to at least 10 million additional compromised devices beyond the 1.3 million identified in the XCPE operation.

Google has banned Videostrong, along with any future subsidiaries or affiliates, from building or selling certified Android devices or supplying software to other certified vendors, and says it has strengthened how it verifies firmware integrity during certification. However, disrupting the control servers does not remove malicious firmware already present on devices in people’s homes.

What device owners can do

Google has not said that every Android TV or Google TV device is compromised, but owners are advised to check the exact make and model of their streaming hardware — found on the device itself, its packaging, or in the device’s settings menu — and compare it against Synthient’s published list. A model match alone does not confirm infection, but owners of the specific MECOOL KM9PRO Max unit tested by researchers are advised to take the warning seriously.

If there is strong reason to suspect a device is compromised, experts recommend disconnecting it from Wi-Fi or unplugging it, and contacting the manufacturer or retailer about a clean firmware update, replacement or refund rather than relying on a factory reset, since the backdoor was designed to reinstall itself. Anyone who signed into Google or streaming accounts on a suspect device should change those passwords from a trusted device and enable two-factor authentication.

Security specialists also suggest reviewing router logs for unfamiliar connected devices, placing streaming boxes on a separate guest network where possible, and avoiding streaming hardware or apps that offer suspiciously cheap access to premium content, which the FBI has previously flagged as a common vector for preinstalled malware.