A large-scale security operation has exposed a problem that many streaming-device owners may not expect: an inexpensive set-top box can become part of a criminal network without the owner knowingly installing malware. Google’s Threat Intelligence Group says it and industry partners disrupted the XCPE backdoor, which had enrolled more than 1.3 million set-top boxes into a botnet.

Google attributes the operation with high confidence to Videostrong Technology Co., a manufacturer and designer of Android-based devices. The company says the backdoor was used for financial gain, with criminal affiliates able to load additional malware and use compromised devices for ad fraud and residential proxy services. This is not a claim that every Android TV or Google TV device is infected. The findings concern specific compromised set-top boxes and associated infrastructure.

How the XCPE botnet used streaming boxes

According to Google, the XCPE backdoor was built into devices and gave operators persistent access that could be used to install other malicious components. Those components were used for activities including advertising fraud, silently adding devices to residential proxy networks and downloading further malware. A residential proxy can make internet traffic appear to come from an ordinary household connection, which can be abused to hide the origin of automated or criminal activity.

Google says the campaign involved a network of command-and-control domains used to manage the devices and distribute affiliate modules. The company and partners took action against those domains and assessed that the disruption would also sever access to at least 10 million additional compromised devices tied to related modules. That broader figure refers to disrupted access across the affiliate ecosystem, not 10 million additional XCPE boxes.

The research from Synthient, which worked with Google and other industry partners, describes MECOOL set-top boxes as a major part of the investigation and documents how the x.cpe backdoor supported additional payloads. The report also describes the wider ecosystem of proxy and malware modules. The important consumer point is that a device can look like a normal streaming box while carrying software that the owner never chose to install.

Google says it has cut ties with Videostrong and banned the company from making devices with preloaded Google apps. It also says the incident exposed a gap in compatibility and security testing: malicious code was loaded after a device’s first boot, using obfuscation to avoid detection during the earlier review process. Google says it has changed its review process in response.

What streaming-device owners should do now

The first step is not to assume that every Android-powered television device is affected. Google’s announcement is about the XCPE backdoor and specific compromised devices. Owners should identify the exact manufacturer and model of their set-top box, check the vendor’s security notices and compare the model with the technical information in the Google and Synthient reports. A generic product name such as “Android TV box” is not enough to establish whether a device is involved.

• Prefer streaming hardware from established manufacturers with a clear support policy and regular security updates.
• Avoid boxes that promise paid channels, premium subscriptions or unusually large app libraries for an implausibly low one-time price.
• Install apps only from trusted stores and avoid sideloading unknown APK files.
• Keep the device and home router updated, and remove unfamiliar devices from the home network.
• If a model is identified as compromised or the vendor cannot provide credible security guidance, disconnect it and replace it rather than relying on a routine reboot.

A factory reset is not a guaranteed cure for malware that was installed at a system level or delivered through a compromised firmware image. If a device is confirmed to be affected, owners should follow the manufacturer’s and security researchers’ guidance rather than assume that deleting apps will remove the backdoor. It is also sensible to review the router’s connected-device list so an unfamiliar box does not remain online unnoticed.

For households, the broader lesson is that streaming hardware deserves the same caution as phones and computers. A television accessory still connects to the home network, can process personal data and can be abused as part of a larger system. The price of a box should not be the only factor in choosing one.

Read Google Threat Intelligence’s XCPE investigation and Synthient’s technical report for the underlying research.

Residential proxy abuse can create a problem for the household even when the owner never sees a pop-up or obvious performance warning. If a compromised device routes someone else’s traffic through a home internet connection, the household’s public IP address can become associated with activity it did not initiate. It may also consume bandwidth, create unexpected network traffic and expose the device to additional malicious software. That is why a streaming box should be treated as a networked computer, not as a harmless cable accessory.

Google’s announcement describes a disruption of the backdoor and related command-and-control infrastructure, but owners should not read that as a guarantee that every previously compromised box has been cleaned. Disrupting the operators’ ability to communicate with malware is different from proving that every affected device has received safe firmware. If the model is specifically identified in a credible report and the manufacturer cannot provide a trusted fix, replacing the device is the safer course.

The wider AI and infrastructure conversation is also changing quickly. Our related coverage looks at the growing AI data-center boom and the risks and questions around AI shopping agents.

Bottom line: Google says the XCPE operation compromised more than 1.3 million set-top boxes. The safest response is to identify your device, check credible security information and avoid unsupported streaming boxes that cannot receive trustworthy firmware updates.