Google announced on November 2, 2026, that it had disrupted the XCPE command-and-control (C2) infrastructure and cut ties with Videostrong Technology Co. Reports put the XCPE botnet at about 1.3 million devices, most of them Android TV set-top boxes. Google separately estimated that disrupting affiliate C2 domains could cut access to at least 10 million additional compromised devices. That estimate concerns a broader pool of devices, not an extension of the XCPE count.
Google said it barred Videostrong from making certified Android devices or supplying software to certified vendors, and changed its device-review process after the incident. Google assessed that Videostrong deliberately developed and operated XCPE for financial gain.
How the XCPE backdoor operated
Google said XCPE code was concealed in device firmware and activated after the first boot, exploiting a gap in certification testing. Most of the affected devices were Android TV boxes, but Google and its partners also identified Android-based karaoke, telehealth and digital-signage devices.
Google attributed several activities to XCPE and its affiliate modules: advertising fraud, residential-proxy networks and delivery of additional malware. It also reported seeing screenshots, keystroke injection, collection of account and system information, and remote commands.
What a Synthient model match tells owners
Synthient lists model identifiers observed in the campaign, including KM9PRO, KM9PRO_MAX, KM7PLUS, LEAP-S1 and UHD_Google_TV_STB. A match means the model string appears in campaign data; it does not establish that an individual device is infected. Synthient’s model list and device records include a KM9PRO record with the brand MeCool, manufacturer SkyworthDigital, product HPR311-MECOOL and model UHD Google TV STB. Those are distinct fields in that record.
Removing the visible app did not prevent its return in the reported case
Business Standard reported that Google found XCPE’s visible app package could reinstall after a restart, even after someone removed it. The finding concerns that reported restart behavior.
MECOOL’s response
In a video published November 5, UG Tech read an email attributed to MECOOL technical after-sales service. The email said Videostrong manufactured MECOOL products, had appealed to Google, and that MECOOL did not advise ordinary users to stop using their devices. That is MECOOL’s reported position.
