> ## Content Index
> Fetch the complete content index at: https://globalfeed.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# How Google shut the hidden door in millions of TV boxes
- URL: https://globalfeed.ai/en/how-google-shut-the-hidden-door-in-millions-of-tv-boxes/
- Published: 2026-11-03T15:52:59.000Z
- Updated: 2026-11-03T15:52:59.000Z
- Description: The XCPE backdoor, preloaded by device maker Videostrong, tied more than 1.3 million boxes into a botnet. What Google did and what you can do about your box.
- Author: GlobalFeed Editor
- Tags: Google, cybersecurity, Android TV, smart home, guide, x-Google, dil-en, elle

The TV box in the living room plays films and series all day, and at night nobody touches it. According to Google’s threat intelligence team, more than 1.3 million such boxes were also doing other work without their owners knowing. In a [detailed report](https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet?ref=globalfeed.ai) published on 3 November, Google said it and its partners took down XCPE, a backdoor that tied those boxes into a botnet, last week. The report says the backdoor was written by Videostrong Technology, the company that built the devices, and placed in their firmware at the factory. Google estimates that the servers it took down in the same operation also cut off access to at least 10 million more devices.

The good news is clear: the door is shut, the manufacturer is banned from making Google-certified devices, and Google has changed its device review so the same trick does not work again. Here is what happened, how the backdoor worked and what you can do about the box at home.

## What happened

Videostrong designs and builds Android-based devices for other brands. Google assesses that the XCPE backdoor and its botnet were deliberately built and run by the company for profit. It sold access to criminal affiliates and loaded their software modules onto the boxes. Google says it found the malware in many device models and brands over several years and does not believe it was a rogue insider or an oversight.

The overwhelming majority of infected devices are Android TV set-top boxes, but Google also saw telehealth devices, karaoke machines and digital signage in the botnet, which is spread around the world.

## How the backdoor worked

Picture a side door in an apartment block that even the building manager does not know about, with the key still in the builder’s pocket. XCPE was a small component in the firmware running with system privileges. If a user removed it, it reinstalled itself from another partition on reboot.

Google describes three layers:

- **Backdoor:** connected the box to a remote control server at every boot and waited for commands, which could silently install apps, run commands and capture the screen.
- **Loader:** since late 2024 a separate package did the main work and hid itself from security researchers’ test environments.
- **Money-making modules:** software that turned the box into a residential proxy carrying other people’s internet traffic, and ad-fraud modules that faked ad views in the background.

A residential proxy means someone browsing the internet uses your home connection instead of their own address. Google says a single box could carry as many as three proxy programs doing the same job, a sign that every device was squeezed for as much money as possible. The backdoor also turned off Google Play Protect app verification so new apps could be installed unchecked.

Code shared by Google shows the malware checking whether the device is a Mecool model. According to [9to5Google](https://9to5google.com/2026/11/02/google-android-tv-box-backdoor-shut-down/?ref=globalfeed.ai), the list of potentially affected devices compiled by security firm Synthient focuses mainly on the Mecool brand.

## What Google did

Google worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. The report lists these steps:

- Legal action to take down the domains and servers Videostrong used to run the botnet and install malware modules.
- Legal action to take down control domains of more than a dozen malware families loaded through the backdoor.
- A ban on Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors.
- Improvements to how firmware integrity is checked on certified Android TV devices.

Google is open about the gap Videostrong exploited: the malicious code stayed hidden during certification tests and loaded only after the device’s first boot. Google says it has changed its review process to close that gap, and calls a manufacturer deliberately infecting its own users an unacceptable breach of trust.

## What you can do about your box

Google’s advice is simple. Buy connected devices such as set-top boxes from reputable manufacturers; Google’s up-to-date [list of certified partners](https://www.android.com/certified/partners/?ref=globalfeed.ai) is the easiest place to start. Install apps from stores you trust and make sure built-in protections such as Google Play Protect are switched on. Be very wary of apps that offer to pay you for sharing unused bandwidth, and review the permissions of any VPN or proxy apps you have installed.

Google notes that backdoor operators, ad-fraud rings and proxy providers work like a connected supply chain, and that while one-off disruptions matter, lasting results need continued work against that infrastructure. The sources do not include a statement from Videostrong.

Cover photo: [Shixart1985, Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Person%5Fuses%5Fremote%5Fcontrol%5Fto%5Fnavigate%5FTV%5Fmenu.jpg?ref=globalfeed.ai), CC BY 2.0\. The device shown is not related to the incident.

Sources: [Google Threat Intelligence report](https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet?ref=globalfeed.ai), [9to5Google](https://9to5google.com/2026/11/02/google-android-tv-box-backdoor-shut-down/?ref=globalfeed.ai), [Android certified partners](https://www.android.com/certified/partners/?ref=globalfeed.ai)