Google said on November 2, 2026 that it and industry partners had disrupted the XCPE botnet, which enrolled more than 1.3 million Android TV set-top boxes worldwide. The operation took place the previous week. Google attributed the backdoor to device manufacturer Videostrong with high confidence and banned it from future certified Android device production.

According to Google Threat Intelligence Group, the manufacturer sold access to criminal affiliates, whose modules conducted advertising fraud, routed traffic through residential internet connections and installed further malware. Google also targeted affiliate command infrastructure, estimating that this would sever access to at least 10 million additional compromised devices reached through other distribution channels.

Synthient, a partner in the investigation, examined a MECOOL KM9PRO Max acquired in late 2025. Its researchers found a preinstalled backdoor with system privileges. The device sent information to a server, received credentials for an MQTT message broker and listened for tasks, including application installations and removals.

Google reported that the firmware backdoor could reinstall itself after removal when a device rebooted. Operators used it for shell commands, screen captures and network reconnaissance. Synthient linked the operation to Videostrong through shared infrastructure, company email addresses associated with backdoor signing and a document on a malware server signed by its research and development director.

Synthient estimated that roughly half a million compromised devices were actively online, with strong concentrations in Malaysia, Mexico and Brazil. It urged organizations to inspect networks for affected hardware, disconnect identified devices, block the indicators in its public research repository and isolate remaining connected devices from sensitive systems.

Google said it had changed its review process after identifying techniques that evaded security testing. Synthient advised consumers to permanently dispose of affected devices because they could contain additional malware. The recommendations address the continuing risk from compromised hardware after the infrastructure disruption.