Google Says a Chinese TV Box Maker Backdoored 1.3 Million of Its Own Devices and Sold the Access to Criminals

Botnets usually start with a hack. This one, Google says, started at the factory.

Last week Google and its partners dismantled the XCPE backdoor, which had pulled more than 1.3 million set-top boxes into a botnet. Google assesses with high confidence that the backdoor was deliberately built, deployed and run for profit by Videostrong Technology Co., a Shenzhen Android device maker that sells boxes under its own name and builds them for other brands. Not a rogue insider, Google says, and not a development mistake.

"A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust," the company wrote.

Living rooms for rent

The business model was simple. Videostrong sold access to criminal affiliates and loaded their malware onto the boxes. Some modules turned a home internet connection into a residential proxy exit node, so a paying stranger's traffic looked like it came from an ordinary household. Others faked ad views or installed more backdoors. Some boxes ran as many as three proxy kits at once.

The backdoor, called x.cpe and sometimes com.oemservice, lives in the firmware with system privileges. Remove it and it comes back on reboot. It switches off Google Play Protect's app checks so it can install apps silently. Operators could run shell commands, capture the screen, inject keystrokes and map the home network, and Google says it watched them do exactly that, copying out account details and opening reverse shells.

It was not only TV boxes. The same code turned up on telehealth devices, karaoke machines and digital signage.

The trail back to Shenzhen

The evidence is unusually personal. The backdoor passes settings to Videostrong's own YokaTV Player app. A GitHub account hosting botnet packages was named yf-videostrong. Researchers at Synthient found a document signed by Videostrong's R&D director in an open folder on a botnet server, and a Videostrong domain sharing an IP address with the operators' control panel.

TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1. Most sat in Malaysia, Brazil, Iraq, Mexico and Taiwan. The US, Germany, UK, Australia and Canada each had roughly 26,000 to 42,000.

Takedown and ban

Google used legal action to seize the domains and servers running the botnet, plus the control domains of more than a dozen malware families loaded through it, working with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Because those affiliates spread their malware other ways too, Google expects to cut them off from at least 10 million more devices, while warning that such operators pivot quickly.

Google also cut ties with Videostrong and banned it, and any future subsidiaries or affiliates, from building certified Android devices or supplying software to certified makers. The company had hidden its code to slip past Google's compatibility and security tests, loading the malicious payload after first boot. Google says it has changed its review process. As of 2 November, Videostrong's website still advertised a "Google Certified Android TV Box."

Plume says the botnet included both certified and uncertified devices. Google has not said how many certified ones were hit. When it sued over the BadBox 2.0 botnet in July 2025, all of its more than 10 million devices were uncertified.

It fits a pattern defenders are learning the hard way: the vendor's own code is now the way in, just as attackers hijacked cPGuard's official update channel this week to plant a backdoor on Linux hosting servers.

The takedown did not remove anything from the boxes. The backdoor is still there, and owners cannot strip it out themselves. TrendAI says cleanup needs vendor action, platform protection or a new device. Synthient, which bought a MECOOL KM9PRO Max and found the backdoor preinstalled, has published 182 affected model names, with MECOOL boxes prominent among them. Its advice to owners is to throw them away.

Some offers on this page may be paid placements or contain affiliate links.