Here is the short answer on android tv box malware: a few checks can tell you whether your box deserves suspicion, but no scan will prove it clean, and the worst version of this threat cannot be removed by you at all. If your streaming box came from a little-known brand, it is worth twenty minutes of your evening.
On November 2, 2026, Google’s Threat Intelligence Group reported that it had cut ties with Videostrong Technology Co., an Android device maker, after finding a backdoor called XCPE preloaded in firmware. Over 1.3 million set-top boxes had been pulled into a botnet, and Google expects its domain takedowns to cut off at least 10 million more compromised devices.
What Google found inside these streaming boxes
This strain of android tv box malware was not something a family downloaded by accident. It shipped on the box, and Google says the maker sold access to the infected hardware. The add-on modules mostly turned homes into residential proxies, which means strangers’ internet traffic could leave through your connection, and some ran ad fraud.
Two details matter for everyday owners. Google describes these modules as silent, with no on-screen prompt, so a working box can look perfectly normal. Google also admits the boxes got through its certification by loading the bad code after first boot, in a way that managed to “exploit a gap in our tests.”
Google has banned Videostrong and its affiliates from building or selling certified Android devices, and says it is tightening firmware checks on certified Android TV hardware.
Which boxes are at risk from android tv box malware
Google has not published a list of consumer models. Its report only says the code sat in “many different device models and brands” over several years, and that the botnet was overwhelmingly Android TV set-top boxes, along with some telehealth, karaoke and signage gear.
The closest thing to a list comes from Synthient, one of the security firms Google worked with. Its public research centers on a MeCool KM9PRO box and lists 182 model names seen in the campaign, though it warns that a name by itself “is not sufficient to confirm compromise.” Here is how to read the signals you can actually check:
| What you find | What it tells you |
|---|---|
| Your model is on Synthient’s list | Treat the box as suspect, but this is not proof of infection |
| Your box is a MeCool model | Highest concern, since the research focuses on this brand |
| The box says it is Google certified | Useful, but not a guarantee, because certified devices were caught up in this |
| The brand is missing from Google’s partner page | A reason for caution when you buy again |
5 checks for android tv box malware at home
These steps will not catch every case of android tv box malware, but they sort a likely problem from a probably fine box. Google’s own help pages describe these Play Store menus on phones and do not cover TV boxes, so the wording on your screen may differ a little.
- Find the exact model. Look at the label on the box or the About screen in its settings, then compare that name with Synthient’s list.
- Look up the certification. Open the Play Store, select your profile icon, choose Settings, then About, and read the Play Protect certification line.
- Confirm Play Protect is running. From the profile icon, open Play Protect, select the settings gear and check that Scan apps with Play Protect is on. Google urges owners to make sure protections like Play Protect are active, and this malware is built to disable it, so treat a switch you never touched being off as a warning sign.
- Clear out bandwidth apps. Remove anything that pays you for unused bandwidth or for sharing your internet, and review what you have allowed any third-party VPN or proxy app to do. Google calls these apps a primary way illicit proxy networks grow.
- Separate or unplug a suspect box. If the model is on the list, unplug it, or at the very least keep it away from the network your laptops and phones use. Isolating smart devices is one of the steps researchers recommend for organizations, and it makes sense at home too.
Can you remove malware from an Android TV box?
For this backdoor, no. Google states plainly that as a system preload, the x.cpe package “cannot be removed by the user,” and that a copy deleted from the app area comes back after a reboot.
That is what makes android tv box malware different from a bad app on a phone. A factory reset is the usual first move with a misbehaving gadget, and it may clear apps you added, but Google’s report does not say a reset fixes this, and we would not count on it. The report also offers no cleanup update and no owner-friendly test. Its indicators are package names, hashes and server addresses meant for security teams.
A common snag is assuming the takedown settled everything. Cutting off control servers is real progress, but Google has not said an infected box becomes safe afterward. Synthient’s advice is far blunter: throw the boxes away for good.
How to buy an Android TV box without malware
Google’s guidance for avoiding android tv box malware is short: buy connected devices only from reputable manufacturers, and check its certified partners page. That page is written around phones and tablets, but it is the list Google points to in this report. Sony, Hisense and LG appear there, while neither MeCool nor Videostrong did when we looked on November 3.
Skepticism about the word “certified” is fair right now. Videostrong’s own website still described products as Google certified on November 2, so look at who makes the box, not just the badge on the listing.
If you are shopping for a replacement, our look at whether the Google TV Streamer is worth it for families covers the current pricing. Already using an older dongle? Our guide to the Chromecast with Google TV update walks through keeping it current.
Frequently asked questions about TV box security
Is there an Android TV box malware scanner?
Not one that Google names for this threat. Its report gives owners no scanner, and the malware is designed to switch off Play Protect, so a clean scan would not prove much.
Are Google certified TV boxes safe?
Certification still helps, but this case shows it can fail. Google says the boxes hid their malicious code until after first boot and is changing its checks.
Should I throw away my MeCool box?
That is what Synthient recommends for these boxes. Google has not told owners to discard them, but it also has not offered a way to remove the backdoor, so replacing the box is the cautious choice.
Should you keep that bargain streaming box plugged in?
If your model shows up on the list, especially a MeCool box, retire it and move your streaming to a device from a well-known maker. If your box comes from a major brand and the five checks look fine, android tv box malware is not a reason to panic, so keep watching with a clear head. Either way, a streaming box should cost you a subscription, not a seat in someone else’s botnet.
