Google disrupts Android TV botnet, but firmware backdoor remains

Google says it and industry partners dismantled the XCPE botnet last week, targeting the infrastructure used to control infected set-top boxes. The operation disrupted the network, but the backdoor built into affected devices’ firmware can survive an ordinary app uninstall.

How a TV box became someone else’s proxy

According to Google, XCPE enrolled more than 1.3 million set-top boxes across multiple brands and models, overwhelmingly Android TV devices. Its researchers assess with high confidence that manufacturer Videostrong intentionally developed, deployed and operated the backdoor for financial gain.

The backdoor secretly loaded affiliates’ malware for ad fraud, residential proxy services and additional malware installation. As a proxy exit node, an infected box routes someone else’s traffic through its owner’s internet connection without consent. Google also observed operators capturing screens, injecting keystrokes and extracting account and device information.

The control network is disrupted; the firmware is not cleaned

Google took legal action to take down the operators’ control domains and servers, alongside control domains used by more than a dozen affiliate malware families. It also banned Videostrong and future subsidiaries or affiliates from making or selling certified Android devices, or supplying software to other certified vendors. Google tightened its firmware review process after finding that obfuscated code loaded after first boot had exploited a gap in its tests.

On affected devices, the x.cpe backdoor—named com.oemservice in some builds—runs with system privileges. If its installed app is deleted, it reinstalls from the device’s OEM firmware on reboot. That is why an ordinary app uninstall is not a reliable cleanup, even after the operators’ infrastructure has been disrupted.

What to check when choosing a box or installing apps

Google advises buying connected devices from reputable manufacturers and points buyers to its Android TV partner list. For apps, it recommends trusted stores, reviewing third-party VPN and proxy permissions, and keeping Google Play Protect active. It also urges particular caution around apps offering payment for “unused bandwidth” or “sharing your internet.”

These precautions do not establish that an already-infected box is clean. Google’s report does not provide a complete consumer list of affected models, and its findings concern devices carrying the malicious Videostrong firmware—not every Android TV box.