Google disrupts XCPE botnet: 1.3m Android TV boxes may have been infected

Google Threat Intelligence Group has announced the disruption of the XCPE botnet. According to the Polish tech site Antyweb, which reports on Google's announcement, the operation was carried out with Japanese police and security companies. The network included around 1.3m Android Smart TV set-top boxes.

What the problem was

According to Antyweb, the malware was designed to activate as soon as the device was first switched on, with no action from the user. The same code was also found in karaoke equipment, advertising display systems and telemedicine devices.

One device analysed was the MECOOL KM9PRO Max box, which the company Synthient bought in 2025. MECOOL is a brand owned by the manufacturer Videostrong. A built-in program sent the device's data and waited for commands from a server. Synthient found that Videostrong pointed to the same IP address as the botnet's administration panel. On that basis, the firm concluded that the manufacturer itself was responsible for installing the code.

Antyweb writes that Videostrong allegedly exploited a gap in certification tests: the code was disguised so that it passed checks, while the actual payload switched on only after the device was started. The box could also disable app scanning by Google Play Protect and install further programs without the owner's knowledge. Operators could take screenshots, simulate key presses and collect data about accounts and devices.

How the devices were monetised

Google says Videostrong sold partners access to the hijacked devices. They were used to generate fake ad impressions and mass app installs meant to inflate statistics on Google Play. The devices also served as proxies: other people's internet traffic passed through the box owner's home connection and looked like ordinary traffic from a home.

What Google did

Google took legal action against the domains and servers behind XCPE and more than a dozen other malware families. It estimates that shutting down this infrastructure could cut criminals off from at least 10m additional devices. The company also ended its cooperation with Videostrong. This covers the production and sale of certified Android devices, including through future subsidiaries and companies linked to MECOOL and Videostrong.

What this means for owners of the boxes

The botnet is currently inoperative, but Antyweb notes that a copy of XCPE remains in the devices' software. After removal, the program could restore itself from one of the partitions on restart. The site says the safest option is to disconnect such a box from the network permanently.

What this means for you

Cheap Android set-top boxes are sold in many countries, so people using MECOOL devices should check whether they own an affected model. The sources do not say whether they were sold in the UK or which models are affected. If you own a box from this brand, it is sensible to disconnect it from your home network until the matter is clarified.