Most of us think about malware as something we catch.
A bad download. A suspicious link. An app we shouldn’t have installed.
But what happens when the threat is already inside the device before you’ve even plugged it in?
In early November 2026, Malwarebytes reported on a case that Google’s Threat Intelligence Group (GTIG) investigated: more than 1.3 million Android TV set-top boxes carrying a hidden backdoor, with criminals allegedly paying for access to the network it created.
The owners didn’t click anything.
They bought a TV box and connected it to their home internet.
And that’s what makes this case particularly concerning for anyone with a smart device in their living room.
What Happened?
According to GTIG, it has high confidence that Videostrong Technology, an Android device maker, built and operated a backdoor known as XCPE for financial gain.
The company reportedly sold access to criminal affiliates, who then loaded their own malicious modules onto the boxes.
The backdoor, referred to as x.cpe (and as com.oemservice in some builds), sits in the device’s firmware with system level privileges. That’s a much deeper position than a normal app.
Google and its partners have since taken legal action against the domains and servers used to control the botnet, and the company has banned Videostrong and its future subsidiaries and affiliates from making certified Android devices. Google also says it strengthened firmware integrity checks for certified Android TV devices.
But the backdoor itself hasn’t gone away from boxes that were already infected.
How Did the Backdoor Work?
The important detail is where the malicious code lived.
Because it was built into the firmware, the backdoor behaved like part of the device itself. According to the reporting, if someone uninstalled it, it reinstalled itself from the /oem/ partition the next time the box restarted.
It could also switch off Google Play Protect app verification, which meant it could install additional software without asking the user.
Google says Videostrong got past its compatibility and security tests by loading the malicious code after the device’s first boot. In other words, the box could look clean when it was checked, then change after it reached a real home.
In simplified terms, the chain looked something like this:
Compromised Firmware → System-Level Backdoor → Criminal Affiliate Modules → Residential Proxy and Fraud Activity → Profit for the Operators
The key point is that the user’s role in the process was essentially zero.
What Is a Residential Proxy, and Why Do Criminals Want One?
A residential proxy network rents out ordinary home IP addresses to paying customers.
That matters because traffic from a home connection looks very different from traffic coming out of a data center.
A website or bank that is suspicious of data center traffic may treat a residential connection as normal. That helps criminals get past IP based fraud controls and reputation systems.
So a TV box sitting quietly under a television can become useful infrastructure for someone else, using the owner’s home internet connection and the owner’s IP address.
What Could This Mean for Owners?
Google’s findings point to several different risks.
Your home connection could be used by strangers. Residential proxy modules routed other people’s traffic through infected boxes, and through the home IP addresses of the people who owned them.
The box could be used for ad fraud. Some modules generated fake ad views and clicks in the background.
Operators could spy on the device and control it remotely. Google observed activity such as capturing live screenshots, injecting keystrokes, collecting account and device information, and opening reverse shells, which give a remote operator command-line access.
More malware could follow. Some affiliate modules were backdoors themselves and could load further modules.
Your IP address could be linked to activity you never started. Proxy traffic can include things like attempts to guess account passwords, which may cause your home IP address to appear in connection with that activity.
None of this would be obvious from the sofa. A TV box that still streams normally can still be doing other work in the background.
Why Doesn’t the Takedown Solve the Problem?
The legal action against the servers Videostrong used matters, because it cuts the connection between the infected boxes and the operators’ current control infrastructure.
But it doesn’t remove the backdoor from the devices.
As Malwarebytes points out, the flaw remains in the firmware of infected boxes, and it could potentially be exploited by other criminals. Uninstalling the app won’t remove it, because it can come back.
There’s another complication. Google hasn’t published a complete list of affected models, so owners may not be able to tell from a model name alone whether a particular box is infected.
This is an important lesson about connected devices: stopping the operators and cleaning the device are two different tasks.
Why Does This Matter for Businesses?
This may look like a home-entertainment story, but the same kind of device shows up in many places.
Break rooms, waiting areas, shared offices, and home offices often contain streaming boxes, smart TVs, and other IoT gear. If those devices sit on the same network as laptops, phones, and work accounts, a compromised box becomes one more thing that’s connected to everything else.
The broader risk for organizations is how easily low-priority devices get overlooked. Nobody thinks of a TV box as part of the security perimeter until it’s doing something it shouldn’t.
That’s why separating IoT devices from work devices is a sensible habit, for businesses and for remote employees alike.
What Does This Mean for Everyday Internet Users?
You don’t need to be an expert to reduce your risk, but it helps to treat every connected device as something that needs a bit of scrutiny.
Here are a few precautions worth taking:
If You Suspect Your Box, Disconnect It
If you think your TV box may be affected, take it offline and contact the seller or manufacturer. Ask whether clean firmware or a replacement is available.
Don’t Rely on Uninstalling
Removing an app won’t remove a firmware level backdoor. If the code is part of the device’s firmware, the fix has to come from clean firmware or a new device.
Buy From Reputable Manufacturers
If you’re replacing a box, choose a known brand with a track record of security updates and support.
Be Careful With “Free TV” Boxes
Boxes advertised as giving you free channels or subscriptions deserve extra suspicion. Malwarebytes has previously reported on similar devices that may route criminal traffic through home connections.
Think Twice About Apps That Pay You for Bandwidth
Apps that offer money in exchange for sharing your internet connection can route other people’s traffic through your home network, which is the same basic model criminals want from residential proxies.
Stick to Trusted App Stores and Keep Play Protect On
Use official app stores and leave Google Play Protect switched on wherever it’s available.
Isolate Smart Devices
Put TV boxes and other IoT devices on a separate network, such as a guest network or a VLAN with restricted outbound access. This doesn’t make the device itself safe, but it helps keep your phones and computers separate from it.
Use Privacy and Security Tools Wisely
A VPN can encrypt traffic from the devices it’s installed on and hide your IP address from the sites you visit. It cannot remove a firmware backdoor from a TV box, and it shouldn’t be treated as a repair for a compromised device. Security works best when several layers work together.
FAQs
What happened with the XCPE backdoor?
Google’s Threat Intelligence Group says Videostrong Technology built and operated a backdoor in more than 1.3 million certified Android TV boxes and sold access to criminal affiliates for financial gain.
Did owners have to download anything to be infected?
According to the reporting, the backdoor was in the device firmware, so owners didn’t need to click or install anything themselves.
What could the infected boxes be used for?
Google observed residential proxy activity, ad fraud, screenshot capture, keystroke injection, collection of account and device information, remote shell access, and the loading of additional malware modules.
What is a residential proxy?
It’s a service that routes traffic through ordinary home internet connections, so the traffic looks like it comes from a regular household rather than a data center. Criminals use it to avoid fraud checks that look at IP addresses.
Was the botnet shut down?
Google and its partners took legal action to disrupt the domains and servers used to control it. However, the takedown doesn’t remove the backdoor from infected devices.
Can I fix an infected box by uninstalling the app?
No. The backdoor lives in the firmware and can reinstall itself after a restart. Disconnect the box and ask the seller or manufacturer about clean firmware or a replacement.
How can I tell whether my box is affected?
It may be difficult. Google hasn’t published a full list of affected models, so the model name alone may not give you an answer. If you have doubts, disconnect it and contact the seller.
Can a VPN protect me from this?
A VPN protects traffic on the devices where it’s installed and masks your IP address from the sites you visit. It cannot clean a compromised box or remove a firmware-level backdoor.
Final Thoughts
The XCPE case is a reminder that not every threat shows up as a suspicious link.
Sometimes it arrives in the box.
A device that looks ordinary.
A setup that takes five minutes.
A connection to your home network that nobody questions.
And a user who never had a chance to say no.
The takedown was an important step, but the lesson goes beyond one company or one botnet. Every connected device in a home or office extends the network a little further, and some of them deserve far more scrutiny than they get.
Because the most overlooked device in the room can still be working for someone else.
