Android TV Box Malware: Is Your Streaming Box Safe?

Google says a Chinese device maker, Videostrong, built a backdoor into the firmware of Android TV boxes and sold access to criminals. The Android TV box malware, called XCPE, sat on more than 1.3 million boxes, mostly set-top boxes, and Google has now banned the company from making certified Android devices.

The uncomfortable part: these boxes passed Google’s own certification. So the usual advice, “just buy a certified box”, isn’t the full answer this time. Section 4 covers what actually protects you.

⚡ Key takeaways

XCPE was a backdoor preloaded in TV box firmware. Google is “highly confident” maker Videostrong put it there on purpose.
More than 1.3 million devices were enrolled. Google says its takedown also cuts criminals off from at least 10 million more infected devices.
The code hid from Google’s tests by loading only after the first boot.
Removing it yourself doesn’t stick: it is a system app and reinstalls itself. Researchers say to disconnect or replace affected boxes.
Safest options: a TV with built-in Google TV/Android TV from a known brand, or a streaming stick from a big brand that ships regular updates.

Table of Contents

What Happened: Google vs Videostrong

On 2 November 2026, Google’s threat intelligence team published details of the takedown. In its Google Cloud blog post on the XCPE botnet, Google says the backdoor and botnet were “intentionally developed, deployed, and operated for financial gain” by Videostrong Technology, an Android device maker.

Google used legal action to take down the domains and servers that controlled the botnet. It also went after the control servers of more than a dozen malware families that were loaded through the backdoor.

Then came the ban. Videostrong and any future subsidiaries can no longer build or sell certified Android devices, or supply software to other certified makers. 9to5Google notes that Google admitted this was a failure on its side, since the boxes were sold as certified.

android tv box malware: a family watching TV in a living room — Most infected devices were TV set-top boxes. · Photo: Ketut Subiyanto / Pexels

How the Android TV Box Malware Worked

XCPE wasn’t an app someone downloaded by mistake. It was baked into the box’s firmware as a system app, with system-level permissions, before the box ever reached a buyer.

According to Google and The Hacker News, the operators could:

Install apps silently and run commands on the box
Switch off Google Play Protect’s app checks first, so installs went unnoticed
Take live screenshots and inject keystrokes
Copy account details, device information and system logs
Map the home network the box sits on

Most of the money came from three things. The boxes were turned into “residential proxies”, so strangers’ internet traffic ran through your home connection. Some ran fake ad views in the background. Others carried extra backdoors.

Why certification didn’t catch it

Google says Videostrong used obfuscation to slip through a gap in Google’s own compatibility tests and load the malicious code only after the device’s first boot. Certification tests look at the box as shipped. The bad code arrived later.

💡 Pro tip

If your internet feels slower at night even when nobody is streaming, a box acting as a proxy is one possible cause. It’s not proof, but it’s worth checking which devices are on your Wi-Fi.

Also readSmart TV Slow? 7 Fixes for Google TV, Samsung and LG

Which Boxes Are Affected?

This is where the reports get fuzzy, so here’s only what’s confirmed.

Detail	What’s reported
Malware name	XCPE (package names `x.cpe` or `com.oemservice`)
Maker	Videostrong, Shenzhen, China
Brand named by researchers	MECOOL (Synthient bought a MECOOL KM9PRO Max and found the backdoor preinstalled)
Devices counted	1,472,554 across 206 models (TrendAI, 3 June to 1 October)
Model list	Synthient published 182 model names, but says a name alone doesn’t confirm infection
Worst-hit countries	Malaysia, Brazil, Iraq, Mexico and Taiwan
Other devices	Telehealth devices, karaoke machines and digital signage

India isn’t named among the top countries in these reports. But MECOOL boxes have been sold here, and Smartprix lists a Mecool TV box price page for India, though most models there show as out of stock. Cheap no-name boxes sold online under labels like “4K Android box” are the bigger worry, because you often can’t tell who made the firmware.

android tv box malware: hand holding a TV remote — Boxes with unclear makers carry the most risk. · Photo: Towfiqu barbhuiya / Pexels

The Catch: A Factory Reset Won’t Save You

Normally, a reset fixes a dodgy device. Not here.

⚠️ Watch out

XCPE lives in the firmware as a system component, so it reinstalls after you remove it or restart. TrendAI says cleanup needs “vendor action, platform protection or replacement of the device”. Synthient’s advice is blunter: retire the hardware.

Google says its takedown should cut criminals off from the control servers, and 9to5Google reports affected devices should be safe to use afterwards. Still, criminals usually rebuild with new servers. And Google admits it expects them to switch tools quickly.

So if you own a MECOOL box, or any box from a brand you can’t trace, my honest advice is to stop using it for anything that involves logging in. A cheap box isn’t worth the risk to your Google account or home network.

How to Check Your Android TV Box: 6 Steps

You won’t find XCPE yourself without technical tools. These steps reduce your risk either way.

Find the real maker. Check the box, invoice and Settings > About. If you can’t find a brand with a working support website, treat it as high risk.
Check Play Protect certification. Open the Play Store, tap your profile, then Settings > About. Google’s help page says “Device is not certified” means it isn’t on Google’s list. A certified label isn’t a guarantee after XCPE, but an uncertified box is worse.
Make sure Play Protect is on. In the Play Store, open Play Protect and confirm scanning is enabled. XCPE turned it off quietly, so if you find it off and didn’t do that yourself, that’s a red flag.
Look at your router. Most broadband router apps show which devices are connected. A TV box uploading lots of data while idle is suspicious.
Never install “earn money from your bandwidth” apps. Google says these are a main way illegal proxy networks grow.
If in doubt, unplug it from the internet. Use the TV’s own apps, or a stick from a big brand, until you’re sure.

💡 Pro tip

Signed in to Google, YouTube or Netflix on a box you no longer trust? After you stop using it, open your Google account’s security page, remove the device and change your password.

Also readIs My Phone Hacked? 9 Checks for Android and iPhone Users

What to Buy Instead

You don’t need to give up on streaming boxes. You just need to know who stands behind the software.

A smart TV with built-in Google TV, Android TV or the brand’s own OS from a big name gets updates from that brand. If your current TV is slow, our smart TV slow fix guide may save you buying anything.
A streaming stick or box from a large company with a clear update record is the safer add-on for an old TV.
Check Google’s Android TV partner list before buying an unfamiliar Android box. Google’s blog points buyers to it.
Be wary of boxes sold with “lakhs of free channels” or “free IPTV” promises. Those often run pirated apps from outside the Play Store, which is exactly how such malware spreads.

Buying during a Diwali sale? The same rule applies to any cheap gadget. Our guide on Diwali sale scams and fake offers has more red flags.

Our Verdict

✅ Our verdict

If you own a MECOOL box or a no-name Android TV box, disconnect it from the internet and sign out of your accounts. For a new purchase, pay a little more for a TV or stick from a brand that publishes updates. XCPE shows that a “certified” sticker is a minimum, not a promise.

The good news is that Google acted and the control servers are down. The bad news is that the boxes are still out there, in homes that have no idea. If you set up a box for your parents or in-laws, check it this week.

Frequently Asked Questions

What is XCPE malware?

XCPE is a backdoor that Google says was built into Android TV box firmware by maker Videostrong. It let criminals install apps, take screenshots and use the box as a proxy for other people’s internet traffic.

Is my Android TV box infected?

You can’t confirm it easily at home. Researchers say a model name alone doesn’t prove infection. If your box is a MECOOL or an untraceable brand, treat it as at risk and disconnect it.

Will a factory reset remove the malware?

Probably not. XCPE is a system component and reinstalls itself. Researchers suggest replacing the device or waiting for vendor action.

Are Google TV and Android TV TVs safe?

Smart TVs and streaming devices from big brands that push regular updates carry much lower risk. The XCPE problem came from one maker’s firmware, not from Android TV itself.

Which TV boxes did Google ban?

Google banned Videostrong and its future subsidiaries from making certified Android devices. Researchers linked the MECOOL brand to Videostrong.

The Bottom Line

The Android TV box malware story is a reminder that cheap hardware can carry hidden costs. If you own an untraceable Android box, unplug it from the internet today and sign out of your accounts. Next, check your phone too with our guide to signs your phone is hacked.

Keep reading

Sources

Android TV Box Malware: Google Bans Maker of 1.3M Infected Boxes