That cheap Android TV box you bought to stream shows might have arrived with a stowaway. Google says it has shut down a backdoor that came preinstalled on more than 1.3 million inexpensive Android TV set-top boxes.
The company’s security researchers say this was not an accident or a hacker slipping in later. They say the device maker built it on purpose to run ad fraud.
Here is what Google found, what the malware did and the simple steps that keep your own devices safer.
The details come from a report by the Google Threat Intelligence Group titled “Shutting the Door on the XCPE Botnet,” published in early November 2026.
Google Says More Than 1.3 Million TV Boxes Were Enrolled In The XCPE Backdoor
Google and its partners dismantled a network that researchers call the XCPE backdoor. It had enrolled more than 1.3 million Android TV set-top boxes.
A set-top box is the little device that plugs into your TV and turns it into a streaming machine. Cheap versions are sold online and in stores, often with a low price as the main selling point.
Google says the takedown is expected to cut off at least 10 million more compromised devices, which shows how big the operation was.
The Company Says The Maker Built It On Purpose
This is the part that makes the story stand out. Google says Videostrong Technology Co., an Android device maker, intentionally built and operated the backdoor.
The malware was preloaded in the firmware. Firmware is the basic software that runs a device from the moment you switch it on, so there was nothing for the owner to install or click.
Google also says the malware reinstalled itself after someone removed it. In other words, you could not simply delete it and move on.
What The Backdoor Was Used For
According to Google, the network was used for ad fraud and for residential proxy networks. Ad fraud means generating fake views and clicks so advertisers pay for traffic that is not real.
A residential proxy network lets other people route their internet activity through ordinary home connections, so it looks like it is coming from a normal household. That is useful for anyone who wants to hide who they are.
In both cases the box in your living room was being used by someone else, using your internet connection, without you knowing.
It Was Not Only TV Boxes
Google says the same type of malware was also found on telehealth devices, karaoke machines and digital signage. That list tells you the problem is wider than streaming gadgets.
It is a reminder that any internet-connected device is a small computer, whether it plays movies, sings along with you or displays a menu on a screen.
And it means the quality of the maker behind a device matters just as much as the device itself.
Google Banned The Maker From Certified Android Devices
Google says it has banned Videostrong from making certified Android devices. Certified devices go through a process that checks they meet Google’s standards, and that status is a signal many shoppers use without realizing it.
The ban does not remove boxes from homes that already have them. That is why the takedown and the steps below are both worth knowing about.
Four Simple Ways To Protect Your Home Network
Google’s advice is practical, and you do not need to be a tech expert to follow it.
- Buy only from reputable makers. A rock-bottom price on an off-brand device can come with a hidden cost.
- Install apps only from trusted stores, not from links, files or websites you found by accident.
- Keep Play Protect turned on. It is Google’s built-in tool that scans apps on Android devices.
- Be wary of any app that offers to pay you for your “unused bandwidth.” That is how some of these proxy networks recruit ordinary people.
Warning Signs Worth Noticing At Home
Malware like this tries to stay quiet, so there may be nothing obvious. Still, a few habits can help you spot trouble early.
Pay attention if a device runs hot or sluggish when you are not using it, if your internet slows down for no reason or if apps appear that you never installed. These are general signs of a device doing work you did not ask for.
If you have an off-brand box and you are concerned, consider replacing it with one from a well-known maker. A modest streaming stick from a major brand costs little compared with the risk of a compromised device on your home network.
Why This Story Matters To Everyone
Most of us treat a streaming box like a toaster: plug it in and forget it. This story shows why that is risky when a device is cheap and the brand is obscure.
The good news is that a major takedown just happened, and the advice for protecting yourself is simple. Buy from names you trust, stay with official app stores and leave Play Protect on.
Share that with the family member who loves a bargain, especially before the holiday sales begin. A great price is only a great deal if the product is clean.
More Stories You May Like
- Walmart Great Value Instant Oatmeal Boxes Shrink From 12 Packets To 10 And Shoppers Call It Pure Evil As One Says The Price Went Up Too
- Wyoming Mayor Says 7, 8 And 9 Year Old Kids Are Zipping Around At 30 Miles An Hour On E-Bikes As Crashes Hit 22 This Year, More Than Double Last Year
- Before You Rent A Storage Unit, Check These 9 Costs And Rules
