Google says a Chinese manufacturer booby-trapped its own Android TV boxes at the factory

The program is called x.cpe. It doesn't come from a dubious download or a remotely exploited vulnerability: it is written into the devices' firmware, the internal software burned in before sale. If you remove it, it reinstalls itself on reboot. On November 2, Google revealed that it had dismantled, the previous week, the network of infected devices it powered, dubbed XCPE.

More than 1.3 million devices were part of this network, mostly Android TV boxes. According to Google's Threat Intelligence Group, its author is not an anonymous hacker. It is a manufacturer, China's Videostrong Technology, which designs devices for other brands. Google assesses "with high confidence" that the company "intentionally developed, deployed and operated" this network "for profit."

Access to your TV, resold to scammers

According to Google's analysis, the program has the privileges of the Android system itself. It can install apps without asking, run commands, take screenshots, simulate keystrokes and collect information about accounts and the device. It also disables Play Protect, Android's built-in antivirus.

Videostrong then sold access to these boxes to criminal customers. They installed their own modules: ad fraud, resale of victims' internet connections as "residential proxies" that hide the origin of other people's traffic, or installation of other backdoors. According to Google, a single device could run up to three of these bandwidth-resale services. Since August 2026, new variants have been disguising themselves as system apps and, in several cases, used a privilege-escalation module to dig in deeper.

TV boxes are not the only affected devices. Google also cites telemedicine devices, karaoke machines and digital advertising displays.

What Google cut off, and what remains in place

Google worked with several partners, including Japan's national police, Lumen and HUMAN Security, to analyze and disrupt this network. It also took legal action to take down the domains and servers that controlled the network. The same operation targets the command servers of more than a dozen other malware families installed through this backdoor. According to Google, this should cut off access to at least 10 million additional compromised devices. Videostrong and its affiliated companies are no longer allowed to manufacture certified Android devices or to supply software to certified manufacturers.

The program itself has not disappeared from the devices. Google names no brand or model and does not say which countries are most affected. It says only that the network is spread across the world. According to BleepingComputer, however, the company Synthient found the program preinstalled on a MECOOL KM9PRO Max box purchased in late 2025.

What should you do if you have a cheap Android TV box?

There is no vulnerability to patch here: the trap came with the device. The right reflexes:

• Check the brand of your boxes against the list of certified Android TV partners published by Google (android.com/certified/partners). Note that Videostrong itself made certified Android TV devices until Google banned it.
• Disconnect it from the internet if in doubt: this stops its malicious activity, but only clean firmware can remove the program.
• In a business setting, look for the indicators published by Google: the x.cpe and com.oemservice packages on devices, and the domains szbboys[.]com and anyevonline[.]com in your network logs. Isolate display screens and other connected Android devices on a separate network.
• Be wary of apps that offer to pay you to "share your connection": Google explicitly cites this type of offer.

It remains unclear which brands sold in Europe shipped with this program. Google urges resellers to demand independent security audits of their subcontractors. For now, buyers have no easy way to know who actually made their box.