Security Alert: 1.3 Million Android TV Boxes Shipped With a Factory Backdoor — Google and Japan's NPA Take Down the XCPE Botnet

Google's Threat Intelligence Group (GTIG) disclosed on November 2 that it had worked with Japan's National Police Agency (NPA) and five security firms to dismantle a botnet called XCPE in late October. XCPE controlled more than 1.3 million Android devices in over 200 countries and regions, most of them Android TV set-top boxes. Google assesses with high confidence that Shenzhen-based manufacturer Videostrong Technology deliberately built the backdoor into its factory firmware and sold access to the devices to criminal groups.

The command servers are gone, but the backdoor is still inside the boxes already sold. The trail started in Japan: Fukuoka Prefectural Police found these devices while tracing the source of unauthorized online banking transfers. For anyone living or doing business in Japan, this is not a distant story.

What happened

In September 2025, Fukuoka Prefectural Police were investigating unauthorized internet banking transfers. Tracing where the access came from, they found home IoT devices carrying a malicious app. The Kanto Regional Police Bureau's Cyber Special Investigation Unit then analyzed the app, traced how the devices were made and sold, and passed its findings to Google. According to Japanese media, the devices were sold through online marketplaces and electronics retailers in Japan and abroad.

In late October, Google used legal action in the United States to take down the domains and servers Videostrong used to control the botnet and push malware modules. It also took down the command servers of more than a dozen related malware families. Lumen, HUMAN Security, Plume, Synthient and TrendAI took part in the analysis and disruption. Google expects this to cut criminals off from at least 10 million more infected devices, which were compromised through other channels and are not part of XCPE itself.

Google ended its relationship with Videostrong and revoked its license to build Android TV devices with Google apps and services. It also banned the company and any future affiliates from making certified Android devices or supplying software to certified vendors. TrendAI observed 1,472,554 infected devices across 206 models between June 3 and October 1, 2026; infections were highest in Malaysia, Brazil, Iraq, Mexico and Taiwan.

Technical analysis: bigger than one vendor

From a systems-design point of view, five points matter for engineers and businesses.

1. A three-layer backdoor

x.cpe (named com.oemservice in some builds) is written into the firmware before shipping. It runs with system privileges and is signed with the manufacturer's key. On boot, it encrypts the serial number, MAC address, model and firmware version, posts them to a registration server, receives MQTT connection details, and then keeps a persistent connection to the command server. Before pushing modules, it turns off Google Play Protect app verification and installs them silently.

From late 2024, a separate loader, com.abc.nexus, ran the malicious modules. From August 2026, small droppers disguised as system apps replaced it. Operators could silently install apps, run shell commands as system, capture the live screen, inject keystrokes, collect account and device data, scan the local network and open reverse shells.

XCPE architecture: on the left, three layers of code in the device firmware (x.cpe backdoor, loader and droppers, revenue modules); on the right, the seized registration server and MQTT command server

The red dashed box is the control plane that was taken down; the three layers on the left are still in the device firmware.

2. Certification checks a snapshot; the attack happens at runtime

Earlier botnets such as BadBox and Vo1d mostly lived on cheap, uncertified boxes. XCPE ran on devices that had passed Google certification. The backdoor used obfuscation to slip through security testing and loaded its malicious code only after the first boot.

Certification inspects firmware at one point in time. If a remote channel can change behavior after shipping, a static review cannot stop it. Google has now added firmware integrity checks to its review. Teams that build devices or client software should monitor post-first-boot behavior continuously.

3. The control plane is down; the data plane is not

Every sample connected to the same MQTT broker. For the operators, that meant central control. For investigators, it was a single point of failure: seize a few domains and servers, and 1.3 million devices go dark at once.

But only the control plane was cut. The self-restoring, system-privileged code in each device's firmware has not changed by a single line; it is now an orphaned backdoor. If a new control channel appears, the risk can return. The only full fix is clean firmware or a new device.

4. Backdoor as a platform

XCPE separated distribution from monetization. The manufacturer supplied the install base and a remote delivery channel, then sold device access to downstream groups. Those buyers loaded residential proxy SDKs (such as Linkfog, NetNut, Honeygain and Traffmonetizer), ad fraud modules and further backdoors.

The attribution came from the operators' own sloppiness. Synthient found a PDF signed by Videostrong's R&D director in an open directory on the botnet's infrastructure. videostrong[.]cn resolved to the same IP address as a command server, and the backdoors were signed using company email addresses. Google concluded this was neither a rogue insider nor a development mistake.

5. Why residential proxies defeat IP-based defenses

Residential proxies send attack traffic out through ordinary home connections. Defenses that rely on IP reputation or blocking foreign IPs stop working, and police find the source harder to trace. TrendAI counted more than 3.8 million residential IP addresses used as exit points between June 3 and October 1.

According to the NPA, at least 737 of the 4,747 unauthorized online banking transfers in Japan in 2025 used this technique, with losses of about ¥1.39 billion. In 2026, more than a dozen corporate intrusions in Japan were also relayed through home IoT devices.

For companies and developers

The key lesson: stop treating an IP address as an identity.

• Do not score risk on IP alone. For logins, transfers and admin access, combine device binding, passkeys (FIDO2) and per-transaction confirmation instead of relying on IP reputation or geo-blocking.
• Rate-limit by account and device. Per-IP counters are easily diluted by large pools of clean residential IPs.
• Isolate IoT devices. Put TV boxes and cameras on office and home-office networks into their own VLAN or guest network, with no access to internal systems or management ports.
• Search your logs. Look for the indicators below in DNS and firewall logs. The domains have been seized, but historical records can reveal devices that were infected.
• Vet suppliers. For ODM and white-label devices, ask where the firmware comes from, how it is signed and how it is updated. Certification is not a substitute for your own checks.

Domains are defanged with [.]; replace it with a dot when searching.

For consumers: how to check

If you have an Android TV box at home, check it in this order.

1. Check the brand and model. Videostrong sells its own MECOOL brand and also builds devices for other brands, so its name may not appear on the box. Synthient confirmed the backdoor was preinstalled on a MECOOL KM9PRO Max bought in late 2025.
2. Do not treat "Google certified" as a guarantee. The affected devices were certified. As of November 2, Videostrong's website still described its products as Google certified.
3. A factory reset may not help. The backdoor reinstalls itself from the /oem partition, so the only full fix is clean firmware. Disconnecting the box stops the abuse but does not remove the infection.
4. If in doubt, disconnect it first. Then ask the seller for a repair or replacement. If clean firmware is not available, stop using the device.
5. Harden your home network. Put TV boxes and other IoT devices on your router's guest network. Turn on multi-factor authentication for online banking and key accounts, and watch for unusual login alerts.

Notes and sources

Attributing XCPE to Videostrong is the assessment of Google's Threat Intelligence Group, not a court finding. At the time of writing, we have not seen a public statement from Videostrong. The NPA's own materials refer only to "IoT devices" and do not name XCPE or Videostrong. Information is current as of November 7, 2026.

• Shutting the Door on the XCPE Botnet (original report by Google Threat Intelligence Group)
• Google disrupts million-device XCPE Android malware botnet, bans TV box maker — BleepingComputer
• Google disrupts 1.3 million device botnet — The Hacker News
• Google and NPA disable Chinese company's backdoor into internet-connected devices — The Japan Times
• 家庭用ＩｏＴ機器に不正ソフト — Jiji Press
• 警察庁とGoogleなどによるボットネットXCPEのテイクダウンについてまとめてみた — piyolog