Google dismantles XCPE, factory malware in Android TV boxes

On November 2, 2026, the Google Threat Intelligence Group (GTIG) reported that Google and its partners had dismantled XCPE, a botnet (a network of devices controlled remotely without their owners knowing) made up of more than 1.3 million TV boxes, the devices that turn a regular television into a smart TV. According to Google, the malware came from the factory and the party responsible is the manufacturer itself, Videostrong Technology Co. Japan's National Police Agency and the firms Lumen, HUMAN Security, Plume, Synthient and TrendAI took part.

What happened

Videostrong, a China-based company that sells the MECOOL brand and builds Android devices for other brands, preloaded a component called x.cpe with system privileges into the firmware (the device's internal software), and it reinstalls itself on reboot. It then sold access to criminal groups, who loaded modules for ad fraud (fake ad views and clicks), for turning the device into a residential proxy (it relays strangers' traffic using its owner's IP address) and for installing more malware. The operators could also capture the screen, run commands, disable Google Play Protect and steal data. Google did not publish a list of models: it says it found the code in many models and brands over several years.

How Google responded

Google used legal action to take down Videostrong's control domains and servers, along with those of more than a dozen malware families loaded as modules, which it estimates cuts off access to at least 10 million additional devices. It also banned Videostrong and any future subsidiaries from building or selling certified Android devices (the ones that ship with Google apps), and adjusted its certification tests, which the manufacturer evaded by loading the code after the device's first boot. In July 2025, Google had already sued the operators of BadBox 2.0, another network of more than 10 million Android devices with preinstalled malware.

Why it matters to your business

Almost all the devices were TV boxes, but Google also found the malware on telehealth devices, karaoke machines and digital signage screens, which are common in waiting rooms, clinics and restaurants. Plugged into the office network, a device like this can be used to map it and open remote connections, and other people's traffic leaves through your company's IP address. On Google's map, Brazil and Mexico are among the affected countries; Colombia is not highlighted.

What to do

1. Take an inventory of the TV boxes, screens and other Android devices in your business, with brand and model.
2. Check Play Protect certification in the Google Play Store: profile › Settings › About. It helps, but it is not enough, because Videostrong got around it.
3. Connect these devices to a guest network or a VLAN (a separate virtual network) with no access to servers or computers.
4. Block the control domains Google published, anyevonline.com and szbboys.com, on your firewall or DNS, and look for outbound connections to ports 3885 through 3887.
5. Be wary of apps that pay you to "share your internet": Google warns they are one of the main ways these networks grow.
6. Replace uncertified devices with models from Android's official partner list. Because the code lives in the firmware, uninstalling apps does not clean an infected device.

How we help you

At Pronetsys we handle business network design with separate segments for guests, screens and work devices, and we configure firewalls to block malicious domains. If you need to replace devices, we can advise you on buying certified hardware. Tell us which devices you have and we will review them with you.

Sources

• Google Threat Intelligence Group: Shutting the Door on the XCPE Botnet (November 2, 2026)
• Google: check Play Protect certification status
• Android: partners shipping certified devices
• Google: legal action against the BadBox 2.0 botnet (July 17, 2025)
• IFA Berlin: Videostrong Technology Co., Ltd exhibitor profile