Your Android TV box could have come with malware already installed

Published Nov 5, 2026, 11:01 AM EST Rich Hein is a veteran technology journalist with more than two decades covering developer, consumer and enterprise topics. Rich's career has been dedicated to service journalism, connecting readers to content that informs and delights. Previously, Rich was vice president and editor-in-chief for Simpler Media Group, director of audience development for IDG and editor/writer for sites like CIO.com, ComputerWorld, CodeGuru and other tech-centric publications. He's received numerous accolades, including the IDG Summit and Azbee awards and has been covered by Medium for his work in audience development. When not at his desk, Rich lives in Daytona Beach with his wife and three dogs. He enjoys playing guitar, surfing and staying abreast of the latest in tech. Inexpensive Android TV streaming boxes have become a popular alternative to streaming devices from established brands that typically cost more. A lot of these are manufactured in China, and then they're sold in the US under different brand names. Like other streaming devices, these boxes provide access to popular streaming apps, but many also offer fewer restrictions on installing third-party software. That flexibility makes them particularly appealing to those looking to access pirated TV shows, movies, and live television. Regardless of how you plan to use it, if you bought one of these devices, you may have gotten more than you bargained for. The Google Threat Intelligence Group recently disrupted the XCPE botnet, which included more than 1.3 million compromised Android TV streaming boxes. Google stated that Chinese manufacturer Videostrong Technology deliberately installed malicious backdoor software in devices. This malware gave bad actors the ability to use these devices for advertising fraud, route internet traffic through their owners’ connections, and install additional malicious software without the owners’ knowledge. The malware was installed before devices were purchased by customers Google points to Chinese manufacturer Videostrong Technology People who bought these devices didn't have to download a suspicious app, visit a malicious site, or do anything at all to end up with malware. Videostrong Technology makes hardware and software for streaming brands sold under several different names. Google’s Threat Intelligence Group says they have “high confidence” that Videostrong Technology intentionally developed, deployed, and operated the backdoor, as opposed to it being a rogue developer, an engineer, or some other lone bad actor. What's even more concerning is that some of these devices are Google-certified. According to Google, Videostrong used methods that were able to hide the malicious code during Google's security testing. They say that the malware was designed to load after the device’s first boot, allowing the boxes to pass Google’s certification without the backdoor being detected. Google has said it’s improving its review process to address issues like this. This isn’t something that happened overnight Google also stated that Videostrong had been developing and evolving this malware since at least late 2021. After the investigation was over, Google banned Videostrong and its affiliates from manufacturing Google-certified Android devices or from supplying software to other certified manufacturers. That's a pretty big penalty considering some of the infected devices had already passed Google's certification process. What hackers could do with an infected Android TV box Criminals were using the devices to make money Credit: Google Adding insult to injury, Google says Videostrong wasn't just infecting devices. It was also selling access to these compromised devices to other cybercriminal groups. These groups used the devices to commit advertising fraud, including generating fake views and interactions with online advertisements that collected advertising revenue. These infected boxes were also turned into proxies, allowing criminals to route internet traffic through their owners’ home connections. This made the criminal activity appear to originate from an ordinary household rather than the criminals themselves. Meanwhile, the box's owner would have no idea their internet connection was being used this way. According to Google, criminals could remotely install software without the owner's knowledge or permission and the backdoor could disable Google Play Protect, Android's built-in security system, making it easier to install malicious apps without triggering the usual security alerts. Hackers could capture screenshots, simulate keystrokes, and collect information including account details, installed apps, and system logs. They could also run commands remotely and scan home networks for other connected devices. That's not to say that every infected box was used for all of these activities, but it does give you an idea of the scope of access these cybercriminals actually had. Why a factory reset might not remove the malware It’s designed to survive a factory reset When I first heard this story, I thought to myself: why not just perform a factory reset to get rid of the malware? Unfortunately, it's not that simple. Normally in situations like this, a factory reset removes installed applications, personal data, and settings, restoring the device to its original factory configuration. However, the XCPE backdoor was embedded in the device's firmware, not simply installed as a regular Android application. According to Google, the backdoor could reinstall malicious components after a reboot, meaning that simply resetting the box wouldn't necessarily get rid of the problem. Because the backdoor was incorporated into the firmware during manufacturing, restoring it to factory settings could leave the malicious code completely intact. Removing the malware completely would mean replacing the compromised firmware altogether with a verified clean version. That's assuming there's one available from a trustworthy source. Since Google has banned Videostrong from its certification program, a verified clean firmware update is unlikely to come from them or any official source. Researchers at Synthient took a closer look at the malware by buying a MECOOL KM9PRO Max and examining its software and firmware. Their research found that the backdoor had system-level access and could reinstall the malicious components even after they were removed. For this reason, Synthient recommends getting rid of confirmed infected devices rather than trying to clean them of the malware. Even if you think you've removed the malware, there is no guarantee that these devices aren't still compromised. Check your device against the list of potentially infected models The first thing you're going to want to do is find your Android TV box’s model number. This is typically located under Settings > System > About, although it may also be on a label on the bottom of your device. Synthient has published a list of 182 device models. Compare your model with this list. Keep in mind that finding a match doesn't necessarily mean your particular device is infected. If your model appears on the list, disconnect it from your home network while you investigate. You might try contacting the manufacturer to find out whether your specific device and firmware version are affected and whether a verified clean firmware update is available. At this point, that seems unlikely. Since the malware was built into the firmware, it's just best to replace it.