A Shenzhen manufacturer allegedly embeds a persistent backdoor and additional malware across millions of Android TV boxes and other connected devices
On 2 November 2026, Google’s threat researchers announced it had led a takedown of XCPE, a botnet that had placed more than 1.3m mostly-Android TV set-top boxes under criminal control.
A Shenzhen device maker, Videostrong Technology, has been identified for deliberately building the backdoor into its products and selling access to criminals.
The Chinese firm has also been banned by Google from producing certified Android devices,, according to BleepingComputer.
The following legal actions had been taken with help from Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI:
- Legal seizure of the domains and servers used to control the botnet
- Takedown of the command servers of more than a dozen malware families that had been loaded through the backdoor
Because those criminal affiliates distributed their malware through other channels as well, Google expects the action to cut off access to at least 10m additional infected devices. The ban covers Videostrong and any future subsidiaries or affiliates, and bars the firm from supplying software to other certified vendors.
The backdoor, called x.cpe, runs with system-level privileges inside device firmware. Also:
- If a user deletes it, it reinstalls itself when the box restarts.
- It also disables Google Play Protect so it can install applications without the owner’s knowledge.
- Videostrong made money by loading affiliates’ modules that conducted ad fraud, turned devices into residential proxies and installed additional malware.
- Google said it has observed operators taking live screenshots, injecting keystrokes, stealing account credentials and opening reverse shells. Videostrong concealed its code to evade a gap in Google’s certification tests and loaded the malicious code only after a device’s first boot.
- It is estimated that there are 1,472,554 infected devices across 206 models between 3 June 2026 and 1 October 2026, with the most infections in Malaysia, Brazil, Iraq, Mexico and Taiwan.
- A document signed by Videostrong’s research and development director had been found in an open folder on a botnet server. Besides TV boxes, other infected devices include telehealth equipment, karaoke machines and digital signage.
Although the botnet servers are offline, the backdoor remains on the boxes, and owners cannot remove it themselves, because cleanup requires vendor action, platform protection or replacement of the device.
As of 2 November 2026, Videostrong’s website still advertised a “Google Certified Android TV Box”. Google has warned that backdoor operators, ad-fraud rings and proxy providers form an “interconnected supply chain,” and said lasting disruption “will require continued targeting of this infrastructure”.
