Google Bans Android TV Box Maker Over Malware on 1.3 Million Boxes - Is Yours One of Them?

Google has banned Android TV box maker Videostrong after finding a backdoor built into its boxes - more than 1.3 million of them, many sold under the Mecool brand.

The short answer: if you own a Mecool box or a cheap, unbranded Android TV box, take it off your Wi-Fi until you have checked it.

The malware sits deep inside the system, so uninstalling an app won't remove it - for most people, the safe fix is a replacement box from a brand Google certifies.

What Google Found

Google's threat team says the backdoor, called XCPE, was "intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.", a box maker based in Shenzhen, China - it was loaded at the factory, not picked up later from a bad app.

"A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust," Google wrote in its report, published on 2 November.

Working with Japan's National Police Agency and several security firms, Google took legal action to seize the servers that controlled the boxes. It also banned Videostrong from building or selling certified Android devices in future.

What the Malware Does

In plain terms, the box quietly works for someone else while it plays your shows. Google and security firm TrendAI found it could:

• Rent out your internet connection. Strangers' traffic was routed through owners' home connections, so it looks like it came from you.
• Click ads in the background. Hidden ad fraud earned money for the operators.
• Spy and take control. Operators could take screenshots, type on the box, install apps silently and run commands.
• Fight back. It turned off Google Play Protect checks, and if you deleted it, it reinstalled itself from a protected part of the system on the next restart.

Which Boxes Are Affected

Videostrong makes boxes under its own name and for other brands. Researchers at Synthient found the backdoor already installed on a brand-new Mecool KM9 Pro Max, and most of the infected boxes another firm found were Mecool models.

Synthient has published a list of around 180 model names, and TrendAI counted 206 models in more than 170 countries. A model name alone doesn't prove your box is infected, but it's a strong reason to check.

The "Google certified" label didn't protect everyone, either. Google says Videostrong found a way to load the malicious code after the box's first start-up, which slipped past its tests.

What to Do Right Now

1. Check the brand and model. Look at the sticker under the box, or open Settings > Device Preferences > About on the box.
2. Unplug it from your network if it's Mecool or unbranded. Disconnect Wi-Fi and any network cable - a box with no internet can't be used by the operators.
3. Don't rely on a factory reset. The malware lives in a part of the system a reset doesn't wipe, and no researcher has confirmed that a reset removes it.
4. Change your Wi-Fi password. Then update your router's firmware, as Synthient recommends after any compromise.
5. Replace it with a certified box. Google's list of certified partners shows which brands it approves.

Why Cheap IPTV Boxes Are the Weak Spot

Cheap unbranded boxes are popular because they come ready for sideloaded apps and free streams. Synthient says they "have gained popularity in the consumer market, especially for piracy" - and that's exactly the corner where a shady factory install goes unnoticed.

A safer setup costs less than you'd think. Use a certified box, install a known player such as TiviMate or Kodi, and get apps from a store or the developer rather than a random APK link.

Got an APK file and you're not sure about it? Our free APK and XAPK analyzer shows what's inside before you install it.

Quick questions