XCPE Can Survive a Reset—Disconnect Suspicious Android TV Boxes

Google and security partners have dismantled the command infrastructure behind XCPE, a backdoor found on more than 1.3 million Android-based set-top boxes. Google says the malware was intentionally built into devices made by Videostrong Technology and used to sell criminal access long after the hardware reached a customer's home.

This was not a normal bad app that slipped through a download. XCPE ran with system privileges from the firmware partition and could reinstall itself after removal when the box rebooted. If you own a questionable Android TV box, the practical response is containment and replacement—not repeated app uninstalls.

What the backdoor allowed

Google's Threat Intelligence Group says XCPE connected infected devices to command servers and downloaded additional modules. Those modules turned home internet connections into residential proxy exits, generated fraudulent advertising traffic, installed more malware, and opened other backdoors.

Investigators also observed sensitive operator actions, including live screen captures, injected keystrokes, account-information theft, network reconnaissance, system-log collection, and remote shell commands. A compromised streaming box therefore creates more than an annoyance on the television. It can lend a household IP address to criminal activity and expose information entered on the device.

Google assesses with high confidence that Videostrong intentionally developed and operated the system for profit. The company has banned Videostrong and its future affiliates from producing certified Android devices or supplying software to other certified manufacturers. Google also says it changed its firmware-review process after the malicious code evaded earlier checks by loading after first boot.

Do not assume every Android TV device is infected

The finding does not apply to all televisions, streaming sticks, or Android TV products. Google found the overwhelming majority of XCPE devices among set-top boxes, plus smaller numbers of Android-based karaoke machines, digital signs, and telehealth equipment.

A model name appearing on a community list is a warning to investigate, not proof that every unit with that label is compromised. Low-cost boxes are often sold under several brands with different firmware. Certification status, seller reputation, update support, and the exact software build matter more than a familiar-looking product shell.

Check certification and Play Protect

On a device with Google Play, open the Play Store, choose the profile icon, then go to Settings > About. Look for the Play Protect certification status. Google says certified devices have passed Android compatibility testing and are eligible to ship licensed Google apps. A device that is not certified may miss system and app updates, use unlicensed Google apps, or lack secure backup behavior.

Certification alone is not an absolute guarantee—the XCPE campaign exploited a gap in Google's previous review process—but an uncertified box is a clear reason to stop entering account credentials and reconsider the hardware.

Keep Play Protect scanning enabled. On Android TV 11 or newer, open the Play Store and go to Menu > Play Protect > Settings > Scan apps with Play Protect. On Android TV 10 or earlier, use Settings > Apps > Security & restrictions > Verify apps. XCPE could interfere with verification, so a setting that repeatedly turns itself off is a serious warning sign.

Disconnect first, investigate second

If the device is unrecognized, uncertified, linked to the affected manufacturer, running suspicious system packages, or producing unexplained network traffic, unplug its Ethernet cable and remove its Wi-Fi access. Do not download an unofficial “cleaner” onto the same box. That can introduce another unknown program while leaving the firmware backdoor in place.

After disconnecting it, open the router's administration page from a trusted phone or computer. Remove the box from the client list, change the Wi-Fi password, install current router firmware, and reconnect known devices with the new password. A separate guest or IoT network can limit what streaming hardware can reach, though isolation does not make infected firmware safe.

Change passwords for accounts used on the box from a clean device, starting with email, Google, streaming, payment, and shopping accounts. Turn on multifactor authentication and review recent sign-ins. If financial information or identity documents were exposed, contact the relevant provider and monitor for unauthorized activity.

A reset is not a reliable cure

A conventional factory reset erases user data and restores the software supplied by the manufacturer. That is the problem here: Google found the primary backdoor in the firmware's OEM partition, where it could return after removal and reboot. The FBI separately warns that factory-installed IoT malware may remain even after a reset.

Replacing the box with a supported, Play Protect-certified product is the safer decision. Buy from a known retailer, confirm the manufacturer publishes updates, use official app stores, and avoid devices advertised as “unlocked” for free premium television, sports, or movies. Those promises are a common route to unofficial marketplaces and hidden proxy software.

Google's takedown cuts the identified operators off from important servers and disrupted malware infrastructure affecting millions of additional devices. It does not turn compromised firmware into trustworthy software. Once a box has provided persistent system-level access to outside operators, removing it from the network is the clean boundary a reset cannot guarantee.