Android TV box botnet (XCPE): how to tell if your streaming box was hit
Quick answer
Google says Android device maker Videostrong Technology built a backdoor called XCPE into the firmware of more than 1.3 million TV set-top boxes and rented them out to criminals for ad fraud and residential proxy traffic (Google Threat Intelligence, Nov 2). Google and partners took down the servers that control it. The code itself is still on the boxes, so if you own a cheap or off-brand Android TV box, it’s worth a five-minute check.
Who’s affected
- Android TV set-top boxes with Videostrong firmware. Google says the backdoor showed up in “many different device models and brands over multiple years” (Google). The firmware has a special code path for MECOOL-branded boxes.
- Scale: more than 1.3 million boxes in the XCPE botnet. Google says cutting the affiliates’ control domains severs access to at least 10 million more infected devices.
- Where: mostly Malaysia, Brazil, Iraq, Mexico and Taiwan. Nearly 44,000 were in the U.S. between June and October, per TrendAI researchers (CyberScoop).
- Not affected: Google TV and Android TV devices from mainstream brands aren’t named. Your phone isn’t part of this.
What the backdoor could do
- Run at system level, and reinstall itself from a protected partition after a reboot if you delete it (Google).
- Quietly load more malware, switch off Play Protect checks and steal data (SecurityWeek).
- Sell your home internet connection as a “residential proxy,” so other people’s traffic exits through your IP address (SecurityWeek).
How to check your box
- Brand check: is it a no-name or white-label box, or a MECOOL? Those are the ones to look at closely.
- App check: Settings → Apps → show system apps. Look for
x.cpe,com.oemserviceorcom.abc.nexus(names from Google’s report). - Router check: if your router shows DNS or connection logs, search for
anyevonline.comorszbboys.com, the control domains Google published. - Play Protect check: if the box has the Play Store, look in its settings for “Play Protect certification.” Uncertified is a red flag. Certified alone isn’t proof: Videostrong was a certified partner until Google banned it.
What to do if it matches
- Unplug it or move it to a guest network away from your laptops and phones.
- Replace it. Deleting the app doesn’t stick, because the backdoor reinstalls on reboot, and no patch is coming.
- Change passwords for any streaming or Google account you signed into on that box.
- No match? You’re fine. Keep the box updated, and buy from brands that list Play Protect certification.
FAQ
- Did Google fix it? Google took down the control servers and banned Videostrong from certified Android devices. The code is still on infected boxes.
- Is my phone at risk? Nothing in Google’s report points to phones. This is about TV set-top boxes.
- Will a factory reset help? No. The backdoor lives in the firmware and comes back.