Google’s Threat Intelligence Group (GTIG) reported on November 2, 2026, that it found the XCPE backdoor on more than 1.3 million Android TV boxes associated with Videostrong Technology. BGR reported that Google and security firms disrupted the botnet during the week before its November 4 account. That action targeted the control infrastructure; BGR says infected firmware could reinstall XCPE after a restart. (BGR’s account of the incident)

What XCPE reportedly did

BGR reports that XCPE was embedded in device firmware and ran with system-level privileges. At startup, it sent details including a device’s serial number and MAC address to Videostrong servers, then waited for instructions. Operators could reportedly install apps without the owner’s knowledge or run shell commands.

The reported activity included ad fraud and residential-proxy use. Google reportedly found as many as three proxy software development kits on one box; on some devices, operators also took live screenshots and retrieved account information. Synthient, a security firm, reportedly found XCPE under the package name com.oemservice on a Mecool KM9PRO Max it bought in late 2025.

A botnet disruption is not a firmware repair

Google reportedly cut ties with Videostrong and barred it from building certified Android devices or supplying software to other certified manufacturers. BGR also reported that Google pursued court action to shut down botnet domains and servers.

Taking control servers offline disrupts communication with infected devices. It does not, by itself, remove a backdoor embedded in their firmware. BGR says that firmware could reinstall XCPE after a restart, so removing the package alone may not resolve an infection.

A match on Synthient’s list of more than 180 models does not confirm that a particular box is infected. The list is not a device-level diagnosis.

Precautions for owners

Synthient’s reported advice for owners of affected boxes was to disconnect the device from the network, change Wi-Fi passwords, and update router firmware. These steps address network exposure; they do not repair infected firmware.

For a separate layer of protection, Kaspersky recommends putting TV boxes and other smart-home devices on a separate Wi-Fi network from phones, computers, and network-attached storage. Separating those devices can limit what a compromised box can reach across a home network, but it does not remove XCPE. (Kaspersky’s network-segmentation guidance)

Keep network isolation and malware removal in separate boxes: one can limit a device’s reach without cleaning its firmware.