AI-generated image: a dim Nordic living room in the evening, a small black unbranded streaming box on a light-wood TV bench below a wall-mounted TV, thin red and cyan light trails rising from the box to a Wi-Fi router on a shelf, candles, a wool throw and a window onto a snowy dusk
Illustration: a small streaming box on a TV bench quietly sending traffic out through the home Wi-Fi router. (AI-generated illustration.)

Android TV box malware – how to check your box after the XCPE botnet

About 5 min read

Analysis

A cheap Android TV box can be a criminal’s tool before it even leaves the factory. On Monday Google said it had taken down a botnet of more than 1.3 million TV boxes whose backdoor, it says, was built in by the manufacturer itself. The awkward part: some of the devices were Google-certified. Here is what the Android TV box malware case means if you own one, seen from Finland.

Key facts

  • According to Google, the XCPE backdoor was on more than 1.3 million devices, and Shenzhen-based maker Videostrong was behind it
  • TrendAI counted 1,472,554 infected devices across 206 models between June and October and calls that a lower bound
  • Synthient found the backdoor preinstalled on a Mecool KM9PRO Max box
  • The backdoor reinstalls itself after a reboot if you remove it
  • The devices were used for ad fraud and for selling owners’ home connections as proxies

What happened?

According to the report by Google’s Threat Intelligence Group, Videostrong sold access to the devices to criminal affiliates. They loaded modules that committed ad fraud and routed other people’s traffic through the owner’s home connection. The backdoor could also take screenshots, run commands and switch off Google Play Protect’s app checks. Google took down the control servers, cut ties with the maker and estimates that its action also cuts off access to at least 10 million other infected devices.

The numbers differ by source: Google says more than 1.3 million, TrendAI about 1.47 million devices. According to TrendAI, Malaysia, Brazil, Iraq, Mexico and Taiwan had the most infections. No figures for Finland have been published.

Why the Play Protect label was not enough

Finland’s National Cyber Security Centre has advised buying only Play Protect certified boxes. That is still good advice, but this time it was not enough on its own. Google admits that Videostrong hid its code so it loaded only after the first boot and slipped past the tests. According to The Hacker News, security firm Plume found that the botnet included both certified and uncertified devices. Google has now changed its checks.

How to check your own box

  • Brand and model: compare your box with Synthient’s report. The researchers say a model name alone does not prove an infection.
  • Certification: open the Play Store, tap the profile icon → Settings → About and look for Play Protect certification.
  • Odd signs: according to the Finnish centre, warning signs include ads where there should be none, redirects to wrong pages, apps that install themselves and connections to unknown addresses.
  • A message from your operator: if your operator says malicious traffic was seen on your connection, take it seriously.

If you suspect an infection

The advice varies a little. Plume recommends a factory reset, but the Finnish centre says malware embedded in firmware is not removed by a reset. TrendAI says cleanup needs vendor action or a replacement device, and Synthient tells owners to get rid of the boxes altogether. The safest route in Finland is the centre’s guidance: disconnect the box, check for an official fix from the maker and, if there is none, take the device to electronics recycling. Use another device to change the passwords of services you used on the box.

The Hilavitkutin tip

When choosing a new box, the cheapest is not the best value. Prefer a known brand that ships updates, and buy from a seller operating in the EU. Google also warns about apps that promise money for “unused bandwidth”. According to the Finnish centre, home devices are also hijacked as proxies through apps, and traffic from one such network was detected in Finland nearly 900 times a day in March 2026.

Read also

Sources

  1. The Verge (2.11.2026): One of Google’s Android partners turned 1.3 million set-top boxes into a botnet (accessed 3 Nov 2026)
  2. Google Threat Intelligence Group (2.11.2026): Shutting the Door on the XCPE Botnet (accessed 3 Nov 2026)
  3. TrendAI Research: botnet of more than 1.3 million pre-infected set-top boxes (accessed 3 Nov 2026)
  4. Synthient: The Internals of a Badbox Operation (accessed 3 Nov 2026)
  5. The Hacker News (2.11.2026): Google Disrupts 1.3 Million-Device Android Botnet (accessed 3 Nov 2026)
  6. BleepingComputer (2.11.2026): Google disrupts million-device XCPE Android malware botnet (accessed 3 Nov 2026)
  7. Mobiili.fi (3.11.2026): Google vahvisti: Android TV -laitevalmistaja jätti laitteisiin takaportin (accessed 3 Nov 2026)
  8. Kyberturvallisuuskeskus (25.6.2025): Haittaohjelma voi lymyillä laitteessa jo ostovaiheessa (accessed 3 Nov 2026)
  9. Kyberturvallisuuskeskus: viikkokatsaus 21/2025 (Android TV -laitteet) (accessed 3 Nov 2026)
  10. Kyberturvallisuuskeskus (18.3.2026): IPIDEA – kotilaitteita hyödyntävä välityspalveluverkko (accessed 3 Nov 2026)
  11. Google Play -ohje: Play Protect -sertifioinnin tilan tarkistaminen (accessed 3 Nov 2026)