Tech brief Breaking

Google Cuts Off a Backdoor Hidden in 1.3 Million Android TV Boxes: What to Do

By , Tech Cheat Codes Team

Published 6 min read

Illustration of a plain TV set-top box with a red warning symbol above it.
On this page · 2 sections
  1. If you own a cheap Android TV box
  2. References

Late last year, researchers at the security firm Synthient bought a MECOOL KM9PRO Max, one of the small Android TV boxes people plug into a TV to stream shows and movies. Before they had installed a single app, they found a program called com.oemservice already living on it. Every time the box started up, the program checked in with a server and waited for orders.

That program was one version of XCPE, a backdoor that Google and a group of partners took down last week and made public on Monday, November 2. Google's investigation concluded "with high confidence" that Videostrong Technology Co., a company in Shenzhen, China, that builds Android TV boxes and projectors for other brands, developed the backdoor on purpose, ran it for money and sold access to criminal groups. More than 1.3 million set-top boxes ended up in the botnet, which is a network of hijacked devices that someone else runs from afar.

The owners had no idea. Nobody saw a consent screen or a warning, and there was no way to opt out, because the backdoor came built into the box's firmware, the basic software that runs the device before you ever see a menu.

What the boxes did behind the TV is the unsettling part. The criminal groups that bought access loaded their own software onto the boxes through the backdoor, and most of it turned the box into a residential proxy, which means strangers' internet traffic was quietly routed through the owner's home connection so it looked like it came from that household. Other add-ons ran hidden ads in the background to bill advertisers for views nobody saw, and some installed still more malware. The operators also used the backdoor to take live screenshots of the screen, type keystrokes into the box and pull off account information and system logs. One of the commands switched off Google Play Protect's app checks so new software could slip on without a prompt.

Synthient's researchers followed the trail in a way that sounds almost too easy. On the malware's own file server they found an open folder holding a signed document from Videostrong's research and development director, and Videostrong's website address pointed to the same internet address as the panel operators used to manage the hijacked boxes. Videostrong didn't immediately respond to questions from The Register.

Google worked with Japan's National Police Agency and the security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google took legal action to take down the domains and servers Videostrong used to control the botnet, along with the control servers for more than a dozen malware families that rode in through the backdoor. Google estimates that knocking out those servers also cuts off at least 10 million other infected devices that were reached through other routes. It cut ties with Videostrong and banned the company, plus any future subsidiaries or affiliates, from building certified Android devices or supplying software to companies that do.

There's an awkward detail in there for Google. Some of these were certified Android TV devices, the kind that come with Google apps, and Videostrong got its code past Google's security tests by hiding it and loading it after the box's first startup. Google has changed its review process to close that gap.

US homes weren't spared. TrendAI counted 1,472,554 infected devices across 206 models in more than 170 countries between June and October 2026. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The United States was one of five countries, along with Germany, the United Kingdom, Australia and Canada, with roughly 26,000 to 42,000 infected devices each, and the hijacked home connections in the US sat on everyday providers like Comcast and AT&T. Most infected devices were TV boxes, but the backdoor turned up on other gadgets too, from telehealth devices to karaoke machines.

If you own a cheap Android TV box

The takedown cut the strings, but the backdoor is still sitting on every infected box. It runs with the highest level of system access, and if you delete it, it reinstalls itself from a protected part of the firmware the next time the box restarts. TrendAI found that owners can't remove it themselves, so a box can only be cleaned with new firmware, and replacing it is the simpler fix.

The brand at the center of Synthient's report is MECOOL, an online store selling Android TV boxes and projectors that Synthient traced to Videostrong. Synthient also tied the YokaTV store to the same operation and found the backdoor packaged on devices from both, so if you bought a box from either one, treat it as suspect. Synthient has posted a list of affected device models in its public research files, which are linked from its report in the References below.

For any other off-brand box, start by checking whether Google certified it. On the box, follow these steps.

  1. Open the Google Play Store app.
  2. Select your profile icon at the top right.
  3. Select Settings.
  4. Select About and look for Play Protect certification.

If it shows the device isn't certified, Google has no record of its compatibility test results. An uncertified box might not be secure or get system updates, and the Google apps on it aren't licensed copies. A certified result is good news, but it isn't a clean bill of health for a Videostrong box, since some of those passed certification.

If your box is on Synthient's list, came from MECOOL or YokaTV, or you can't tell who made it, take it off the internet. Unplug its network cable or remove your Wi-Fi network from it. Synthient goes further and tells owners to get rid of these boxes for good, since they carry a high risk of more malware. The same report suggests changing your Wi-Fi password and updating your router's software afterward to cut the risk of reinfection. Synthient also found that when a box checked in with the operators' server, it sent along the email address of whoever was signed in.

When you shop for a replacement, Google points buyers to reputable manufacturers and keeps a list of partner brands on its Android TV website. Google also warns against apps that offer to pay you for "unused bandwidth" or for sharing your internet connection. During its months of watching, TrendAI saw the operators push silent app installs to more than 187,000 boxes. TrendAI also notes that operators like this have rebuilt on new servers before.

Want the next fix in plain English? Follow Tech Cheat Codes on Facebook. Tap this link, then tap Follow: Follow Tech Cheat Codes on Facebook

References