Is your Android TV box one of the ones in the news?

What happened

More than 1.3 million Android TV set-top boxes were in a botnet called XCPE, which Google and its partners have taken down (Google, Krebs on Security). Google's threat team estimates the takedown should cut access to at least 10 million more compromised devices (Krebs on Security). The software secretly rents the owner's internet connection out to strangers and runs advertising fraud (Krebs on Security).

Google says, with high confidence, that the maker Videostrong Technology Co. built it in on purpose, across many device models and brands over several years. Google says it cut ties and banned the company from making certified Android devices (Google).

Synthient's report examined a MECOOL-brand box from Skyworth and concluded it bundled the same malware (Krebs on Security).

The software is built into the firmware at manufacture (Google, BleepingComputer). Google says it can switch off Google Play Protect's app checks (Google).

How to check your box

1. Look up the model name. Synthient publishes a list of backdoored model names. The list itself says: “A model name alone is not sufficient to confirm compromise.”

2. Check certification. In the Google Play Store app, select your profile icon, then Settings, then About, which shows whether the device is Play Protect certified (Google's steps). Google says uncertified devices may not be secure, and may not get system or app updates. Google says only certified devices are eligible to include the Play Store app, so a box without it can't pass this check. Fire TV devices are a different case: they run Amazon's Fire OS and use the Amazon Appstore instead of Google Play, so this check doesn't apply to them.

Certification lowers the risk, but it isn't a guarantee. Google says Videostrong got past its tests by loading the malicious code after the device's first boot, and that it has since changed its review process (Google).

3. Look for warning signs. The FBI listed these in a June 2025 warning about a similar botnet, BADBOX 2.0 (FBI). Each one is a sign, not proof:

• Apps from suspicious marketplaces
• A device that requires Play Protect to be turned off
• A generic box advertised as unlocked or able to access free content
• A brand you can't recognize
• Not Play Protect certified
• Internet traffic you can't explain

What to do if it looks affected

The FBI urges people to consider disconnecting suspicious devices from their networks (FBI). If your box looks affected, consider disconnecting it from your network.

BleepingComputer reports that the takedown didn't remove the software from the boxes, that it reinstalls itself if removed, and that getting rid of it takes clean firmware; disconnecting the box from the internet stops further activity. So, in our view, don't count on a factory reset to remove it.

Free TV that doesn't need a box like this

You can watch in a browser, with no sign-in, from the channel directory. Official free streams lists the channels broadcasters stream free on their own websites.

On a TV, our free app has a page for each kind of device: Google TV (in testing on Google Play), Fire TV, and Android TV and Nvidia Shield.

Broadcast Atlas never asks you to turn off Play Protect. Our Fire TV steps do have you turn on “Install unknown apps”, and that switch covers the one app you choose. On some older models the switch is called “Apps from Unknown Sources” and may apply to the whole device.

Devices our app pages list

Devices also shown on our Android TV and Fire TV pages. No device comes with a guarantee.

• Nvidia Shield TV ProThe device the app is built and tested on.

As an Amazon Associate, Broadcast Atlas earns from qualifying purchases.