Google says the TV box maker put the backdoor in itself, and sold access to criminals

Nobody got tricked into installing this one. The malware was already on the box when it left the factory. Google announced on 2 November that it had cut off XCPE, a backdoor running inside more than 1.3 million Android TV streaming boxes, and it named the culprit with unusual bluntness: Videostrong Technology, a manufacturer in Shenzhen, which Google says "intentionally developed, deployed, and operated" the malware for money.

The backdoor runs as system apps called x.cpe and com.oemservice, with full system privileges. Its operators could silently install apps, switch off Google Play Protect, take screenshots, type on the box's behalf and open a remote shell. Mostly, though, they rented it out. Paying affiliates used the boxes for ad fraud and as residential proxies, which means strangers' internet traffic leaving through your home connection, under your IP address. Researchers at Synthient found it preinstalled on a MECOOL KM9PRO Max bought in late 2025, and published a list of 182 model names. TrendAI counted 1,472,554 infected devices across 206 models between June and October, with roughly 26,000 to 42,000 each in the US, Germany, the UK, Australia and Canada.

Google has revoked Videostrong's licence to ship certified Android devices, and the takedown also cut off at least 10 million more devices infected with related malware. That stops the current operation. It doesn't clean your box. The backdoor lives in a protected part of the firmware and reinstalls itself if you remove it. If you own a MECOOL box or another no-name streamer, check it against Synthient's list. Unplugging it from the internet stops the abuse, and Synthient's own advice is to throw it away. A model on that list isn't proof of infection, but a box like that costs less than the trouble.

Tendvane's Network scan lists every device on your home network, which is the quickest way to find the forgotten streaming box behind the TV.