Google and its partners disrupted XCPE, a botnet involving more than 1.3 million Android TV set-top boxes, the company announced on November 2. The action removed the criminals’ remote access to the boxes. However, the malicious software remains hidden in their firmware.
For those who bought the boxes, the concern is what will happen now. A review of findings from Google , TrendAI , and Synthient, and of MECOOL warranty page on November 3 showed no indication of an XCPE-related product recall, a clean-firmware update, or mass-replacement scheme that has been put in place. The review only included documents that have been made public, and not into any particular seller’s responses.
Google Disrupts 1.3M Android TV Botnet: XCPE Backdoor and Market Impact
How the preinstalled agent phoned home
The malware came with the device. Google found that x.cpe, known as com.oemservice on some devices, came preinstalled in the firmware with system-level access. Even if removed, it reinstalls from the /oem/ partition after a reboot.
Once the device was powered on and established a connection to the web, the preinstalled agent began communicating with its controllers and sending commands to com.abc.nexus or newer loaders.
The criminals could use the MQTT messages to install applications without permission, execute commands, and record screens. According to TrendAI, the system app is digitally signed with the manufacturer’s key. This complicated the ability of the owners to remove it.
Who Google blames
Google says it is highly confident that Videostrong deliberately built and operated the backdoor to make money. The manufacturer allegedly disguised the malicious code to get past Android’s certification checks.
In response, Google banned Videostrong and its future affiliates from making certified Android devices or supplying software to certified vendors. It also strengthened its firmware checks. Japan’s National Police Agency and several security firms worked with Google on the takedown.
Following the money into home broadband
The scam took advantage of home internet connections to generate income. Infected TV boxes functioned as residential proxies, giving others access without the knowledge of the owners of the infected boxes. Also, the attackers implemented ad fraud programs. From June 3 to October 1, 2026, TrendAI monitored 3.85 million unique residential exit IP addresses.
Connections to home networks are useful for criminals, as their activity looks legitimate. According to the FBI , this is a result of the use of residential proxies that make criminals seem like ordinary consumers. Advertisers face similar dangers. DoubleVerify has detected 140% more schemes and variations of connected-TV fraud in Q1 2026 than a year earlier. However, not all of these scams fall under XCPE’s category.
Which boxes, and what owners can do
Synthient examined a MECOOL KM9PRO Max and listed model strings including KM9PRO_MAX, KM7PLUS and KD3. A matching name alone does not prove infection.
MECOOL’s warranty offers 30-day returns and one-year coverage for quality issues, but no XCPE-specific remedy. Worried owners should disconnect suspected boxes and ask sellers for a documented fix or replacement.
Why a dead C2 is not the end
Google also targeted affiliate control domains, which it estimates could cut off at least 10 million additional compromised devices. Those are separate from XCPE’s 1.3 million.
The risk of a comeback is real. An earlier, different Android TV botnet grew from 74,000 devices in 2023 to more than 10 million by 2025, as Cryptopolitan reported .
The market is much larger still. Grand View Research forecasts $318.6 billion in global connected-TV revenue for 2026. Pixalate puts Roku’s share of global programmatic CTV ad activity at 36%. Neither figure measures XCPE losses.
The smartest crypto minds already read our newsletter. Want in? Join them .
