- Hidden malware found inside Android TV boxes
- More than 1.3 million devices affected worldwide
- Criminal use of infected boxes for proxy traffic and ad fraud
- Malware built into firmware and hard to remove
- Google’s response and manufacturer ban
- Steps users can take to check and protect their devices
Android TV boxes are supposed to make streaming simple, not turn a living room setup into a security headache. But investigators say that is exactly what happened in a sprawling malware scheme tied to more than 1.3 million devices around the world. The disturbing part is that some of the infected hardware was already compromised before buyers ever plugged it in.
Google’s Threat Intelligence Group says the operation centered on a China-based manufacturer that allegedly built a hidden backdoor into Android-powered streaming devices. That backdoor, known as XCPE, reportedly gave remote operators access to the boxes and opened the door for more malware to be installed later. In plain terms, the device could look normal on the outside while quietly acting for someone else behind the scenes.
What makes the case hit harder is that some of the affected devices apparently passed through Google’s own certification process. That means buyers were not just trusting the product itself, but also relying on a security system that should have caught the problem. Instead, the malicious software was concealed during testing and then activated after the first startup.
Once inside a box, the malware was more than a nuisance. Google says criminals used the infected devices for residential proxy networks, which route suspicious activity through someone else’s home internet connection. That can make shady online behavior look like it came from an ordinary household, while the owner has no clue anything unusual is happening.
The infected boxes were also reportedly used for fake ad activity, with malware loading ads or simulating interactions to generate cash for the operators. On top of that, researchers found signs of screenshots being captured, keystrokes being injected and sensitive account details being collected. The whole thing paints a pretty ugly picture of a device that could sit quietly in the background while doing serious damage.
Another nasty detail is how stubborn the malware could be. Google says the backdoor was embedded in firmware, the software layer that helps hardware run at the most basic level. That means removing one visible app or doing a quick reset may not clean the problem out, since the infection can come back after a reboot.
Researchers identified one confirmed infected unit, a MECOOL KM9PRO Max streaming box, and also pointed to a wider group of models linked to the botnet. Those identifiers included KM9PRO_MAX, KM9PRO, KM2PLUSDELUXE, KM2PLUS, KM7PLUS, KT1, IPx1, IPx3, Q96MAX and TX3MINI. Even then, the warning is important: a matching model name does not automatically prove a device is infected.
The campaign did not stop at streaming boxes either. Google says the malware also showed up in Android-powered karaoke machines, digital signage products and even some telehealth devices. That spread matters because the retail name on the box is not always the company that actually built the hardware or firmware underneath it.
Google says it worked with Japan’s National Police Agency and security partners to break up the botnet, shut down control servers and block the domains used by the operation. The company also banned Videostrong and related entities from building or supplying certified Android devices. That is a strong move, but it does not magically erase malicious firmware from gadgets already sitting in homes.
For anyone worried about a streaming box already hooked to the network, the safest move starts with checking the exact brand and model. If the device matches a model tied to the operation, it deserves a serious second look. A factory reset may feel reassuring, but with firmware-level malware, that is not always enough.
It also helps to look at the bigger home network picture. A router update, a close look at connected devices and a separate guest network can all reduce the blast radius if something goes wrong. And if a box was used to log into streaming services or a Google account, changing passwords and turning on 2FA is a smart follow-up.
Cheap streaming hardware can look like a bargain until the bill shows up in a different way. The problem with this kind of malware is not just that it steals resources, but that it can turn a private home connection into part of a criminal machine. That is the sort of invisible mess that tends to linger long after the box itself is forgotten.
