XCPE is a botnet that Google disrupted in late October 2026 after finding it preinstalled in the firmware of more than 1.3 million Android TV streaming boxes. Google attributes it with high confidence to the Chinese device maker Videostrong Technology Co., and says the takedown also cut off at least 10 million more compromised devices. The takedown stopped the command servers, and it did not clean any devices. If you own a cheap Android TV box, you should check it, and if it is infected, the realistic fix is clean firmware from a source you trust or a replacement.

"google android botnet takedown" climbed the US Google Trends technology chart last week, up 100 percent. This guide explains what XCPE is, how to check a device at home, what to do if you find it, and what the case means for developers. Everything here comes from Google's November 2 report, Synthient's technical analysis and BleepingComputer's coverage, and anything uncertain is marked.

What is the XCPE botnet?

XCPE is a backdoor built into device firmware during manufacturing. Most botnets get onto devices through a software bug or a tricked user. Here the malware was already on the box when it left the factory, in components named x.cpe and com.oemservice that run with Android system privileges.

Infected boxes contact a registration domain and then take orders through an MQTT broker. According to Google, operators could silently install apps, disable Google Play Protect, run shell commands, take screenshots, inject keystrokes, collect account and device data, scan the local network and open reverse shells. Google's report says Videostrong sold access to criminal affiliates and loaded their modules onto infected devices, and it called this "an unacceptable breach of trust."

The money came from renting the boxes out. Affiliates used them as residential proxies, ran ad fraud and installed further backdoors. Your home connection could carry someone else's traffic without you knowing.

Which devices are affected?

Google doesn't publish a list of affected brands or models. It says the malware appeared across many models and brands over several years. Most infected devices are Android TV set-top boxes, and the wider group also includes telehealth devices, karaoke machines and digital signage. Not every one of the extra 10 million devices runs Android.

The one model named in public reporting is the MECOOL KM9PRO Max, where the security firm Synthient found the malware preinstalled on a box bought in late 2025. That one example doesn't tell you other MECOOL boxes are infected, and it doesn't clear any other brand.

Your risk is highest if your box came from a marketplace at a very low price, has an unfamiliar brand, or promises free streaming channels. A device from a well-known TV maker or a major certified streaming brand sits in a different category, although Google has not said that certification guarantees safety. Videostrong itself got around Google's testing by loading the malicious code after first boot, and Google has since changed its review process.

What did Google do, and did it fix my device?

Google took down XCPE command servers used by more than a dozen related malware families. It ended its relationship with Videostrong, revoked the company's license to build Android TV devices with Google apps, and barred it and future affiliates from making certified Android devices or supplying software to certified vendors. Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI took part.

The takedown does not remove the malware from your box. BleepingComputer reports that XCPE reinstalls itself from the /oem/ partition if you remove it, and Google says a reinstall occurs on reboot. Uninstalling an app or doing a normal factory reset may leave it in place, because the code lives in firmware. Google also notes that since August 2026 the operators have been replacing their loader with smaller droppers disguised as Android system apps, so a device that looks clean today could still receive something new if it reaches other infrastructure.

How to check if your Android TV box is infected

Google gives no one-tap consumer test. It publishes indicators that security teams can search for. You can use three of those checks at home, from easiest to most technical.

1. Check the brand against Google's certified partner list

Open Android's certified partners list and look for your device's maker. If the brand isn't there, treat the box as untrusted. On a phone or tablet, you can also check certification in Google Play by opening your profile, then Settings, then About, and looking for Play Protect certification. The menu on TV devices may be arranged differently.

2. Look for the known package names

If your box allows USB or network debugging, you can list its packages from a computer with Android's adb tool. Enable developer options on the box, connect, and run:

adb connect 192.168.1.50:5555
adb shell pm list packages | grep -E 'x\.cpe|com\.oemservice|com\.abc\.nexus|com\.vs\.grass|com\.android\.sso\.auth\.handler|com\.android\.system\.ntp'

Replace the IP address with your box's address. Any match is a strong reason to stop using the device. An empty result is only mildly reassuring, because these names come from one published report and malware authors can rename things. This command has not been run against a real infected box for this article.

3. Search your router or DNS logs for known domains

This is the most useful check, because it doesn't depend on what the box tells you about itself. If your router, Pi-hole or DNS service keeps query logs, export them and run the script below. It searches for the core domains Google lists and shows which local device asked for each one.

#!/usr/bin/env python3
"""Search a DNS or router log for XCPE domains that Google published.

Usage: python3 check_xcpe.py dns.log
"""
import collections, re, sys

DOMAINS = ["szbboys.com", "anyevonline.com", "intermedia-arts.tv", "yokatvonline.com"]
PATTERN = re.compile(
    r"(?<![\w-])((?:[\w-]+\.)*(?:" + "|".join(map(re.escape, DOMAINS)) + r"))\.?(?![\w.-])",
    re.IGNORECASE)
CLIENT = re.compile(r"\b(?:\d{1,3}\.){3}\d{1,3}\b")

hits = collections.Counter()
with open(sys.argv[1], encoding="utf-8", errors="replace") as log:
    for line in log:
        match = PATTERN.search(line)
        if match:
            client = CLIENT.search(line)
            hits[(client.group(0) if client else "unknown", match.group(1).lower())] += 1

if not hits:
    print("No matches. That only covers the time range and devices in this log.")
for (client, domain), count in hits.most_common():
    print(f"{client:<16} {domain:<32} {count}")

The script was tested on a small hand-written sample log, including lookalike domains such as notszbboys.com that it must ignore. It hasn't been run against real infected traffic. Google's report lists more than 100 further domains tied to affiliate malware, so add them to the list if you want wider coverage. Since the servers were taken down, a device that keeps looking up these names is exactly what you are hoping to catch, even though the requests now fail.

Warning signs you can notice without any tools are weaker evidence. Unexplained upload traffic while the TV is off is worth investigating, and Play Protect being switched off when you never touched it is more serious, since Google says the malware specifically tries to disable it.

What to do if your box is infected

  1. Disconnect it from the internet first. BleepingComputer notes this stops further malicious activity while you decide what to do.
  2. Don't rely on a factory reset. The reinstall comes from a firmware partition.
  3. Decide whether clean firmware is realistic. Owners need clean firmware to fully remove XCPE, but the party that would normally supply it is the one Google accuses. For most people, replacing a cheap box is the safer and less time-consuming option.
  4. Sign out of every account you used on it. Remove the device from your Google account's device list, and change passwords for streaming services and anything else you typed on the box, since the malware could capture keystrokes.
  5. Check your router. Confirm its DNS settings and admin password haven't changed, and look for port forwarding you didn't set up, because the malware could scan your local network.
  6. Check the other devices at home. If a phone or laptop shows odd behavior, scan it with your usual tools. Consider putting smart TVs and streaming boxes on a guest network from now on, so one bad device can't reach your computers.

Why would anyone turn a TV box into a proxy?

A residential proxy lets a customer send traffic through someone's home connection, so a website sees an ordinary household instead of a data center. That is valuable to people running ad fraud or trying to get past blocks, and a box that stays plugged in all day is a convenient exit point. Google says that in its analysis these proxy operators generally ask for consent only when platform rules force them to, and that silently enrolling devices remains the most common way they gain exit nodes.

For an owner, this can show up in several ways. Your IP address may get flagged by websites, you may see more captchas, and your connection can slow down at odd hours. None of these proves an infection, since many ordinary things cause the same symptoms. Combined with an unfamiliar box on your network, they justify running the checks above. The legal and reputational risk is the less obvious part, because abuse traced to your connection points to your account first.

How to avoid buying another one

Google's advice is short and practical. Buy connected devices from reputable manufacturers and check the certified partners list before you pay. Keep Play Protect on. Use app stores you trust. Review permissions for third-party VPN and proxy apps. Be suspicious of any app offering to pay you for unused bandwidth or for sharing your internet connection, since Google describes that as a common way illicit proxy networks grow.

Price alone is a poor test, but an unusually cheap box advertising free premium channels should make you stop and check. Look for the maker's name on the certified list and search that exact model number along with the word malware before you buy.

What developers and small teams should take from this

If you run an online service, traffic from these boxes looks like ordinary home users. A residential IP address is weak evidence that a real person is behind a login, a signup or an ad click. If you are relying on IP reputation to stop abuse, add rate limits per account and watch behavior over time.

If you ship Android TV apps, your users may be on compromised hardware, and you can't fully trust that device. Keep long-lived secrets off the box, make sessions short and revocable, and verify purchases on your server. Assume a screenshot or keystroke capture is possible on low-cost hardware.

If you manage an office network, include streaming boxes and digital signage in your inventory. Google's list of affected devices includes signage and telehealth equipment, and those are the devices that tend to sit on a network for years without anyone looking at them.

If you like solving this kind of problem with small scripts, the Python Automation Scripts Pack is a $9 collection of 100 Python projects with source code, sample files and README guides, covering jobs such as cleaning CSV data and monitoring websites. It is general automation code and doesn't include a malware scanner.

Frequently asked questions

Is my Android phone infected with XCPE?

Google describes XCPE as mainly affecting Android TV set-top boxes, along with some other Android-based devices. Google's report doesn't mention ordinary phones as a target, so a phone isn't the main concern. Keep Play Protect active all the same.

Does a factory reset remove XCPE?

You shouldn't count on it. The backdoor is built into firmware and reinstalls from the /oem/ partition. Clean firmware is what removes it.

Is Google TV or Android TV unsafe?

The problem Google describes is one manufacturer's firmware. Google has banned that company and changed its checks. Buying from a certified, reputable maker lowers your risk without eliminating it.

Which brands used Videostrong firmware?

Google doesn't name them. The MECOOL KM9PRO Max is the one model cited in Synthient's analysis.

Is the botnet dead?

It has been disrupted. Google itself says lasting disruption needs continued work, and infected boxes keep their malware until they are cleaned or replaced.

Sources