Hidden malware found in more than 1.3 million streaming devices
A streaming box can seem harmless: plug it into your TV, connect to Wi-Fi and settle in to watch a show. But a global investigation found that some Android-powered devices may have arrived with hidden software that gave criminals remote access.
Google’s Threat Intelligence Group said it had high confidence that China-based manufacturer Videostrong Technology deliberately installed a backdoor in some of its devices. Researchers identified more than 1.3 million affected devices around the world. Many were Android TV boxes, though the operation also involved other connected products.
The troubling part is that the malware was built into the devices, and some affected products had passed Google’s security certification process. So buyers may have taken ordinary precautions and still ended up with compromised hardware.
Google says Videostrong developed and installed malware called XCPE, then sold access to affected devices to criminal affiliates. Those operators could add more malicious software and use the devices as part of a botnet—a group of machines controlled remotely without their owners’ knowledge.
Some of the infected devices were used in residential proxy networks. These let people route online activity through someone else’s home internet connection, making suspicious activity appear to come from that household. Other malware modules secretly generated advertising activity for the operators.
Researchers also saw operators capture screenshots, record keystrokes, collect sensitive account information and install additional software. Much of this could happen quietly in the background, while the device continued playing streaming video as usual.
Google says Videostrong concealed the malicious software during security testing. The backdoor could then load more code after the device’s first startup, taking advantage of a weakness in the review process. The malware could also disable Google Play Protect app verification, one of Android’s built-in security features.
XCPE was embedded in the device firmware, which handles basic hardware operations. That made it difficult to remove: researchers found that even if the visible malware package was deleted, the firmware could reinstall it after a reboot. A factory reset might not clear the underlying infection.
Google has not published a complete list of affected retail products. Cybersecurity researchers at Synthient, however, reported finding the backdoor on a MECOOL KM9PRO Max streaming box they examined in late 2025. Their test device used firmware version C1.0.8_20250325, and the malware appeared under the package name com.oemservice. That finding applies to the sample they tested; it does not prove that every unit with the same firmware is infected.
Synthient also reported model identifiers seen in data linked to the botnet. They include KM9PRO_MAX, KM9PRO, KM2PLUSDELUXE, KM2PLUS, KM7PLUS, KT1, IPx1, IPx3, Q96MAX and TX3MINI. A matching model name by itself does not confirm that a particular device is compromised.
The investigation found infections in other Android-powered products, including karaoke machines, digital signage equipment and some telehealth devices. Google says the malware appeared across different brands and models over a period of several years. The brand printed on a box may not be the company that made its hardware or firmware, which can make it harder to identify a device’s origins.
Google worked with Japan’s National Police Agency and cybersecurity firms to disrupt the operation. It took legal action to shut down domains and servers used to control infected devices and install malware. Google also targeted infrastructure linked to more than a dozen other malware families, saying those efforts were expected to cut off criminal access to at least 10 million additional compromised devices. That figure refers to other malware networks, not just the XCPE operation.
Google says it has ended its relationship with Videostrong and barred the company, its future subsidiaries and affiliates from making or selling certified Android devices or supplying software to other certified vendors. It has also strengthened parts of its security review process, including checks on Android TV firmware.
Disrupting the servers used by criminals does not necessarily remove malware already embedded in devices at home. Google has not said that every Android TV or Google TV product is affected, but the investigation is a good reason to check what is connected to your network.
Start by finding the exact make and model of your streaming box. Check the label on the device or its packaging, or look in the device information section of Settings. Compare the details with the model identifiers reported by researchers. A match is a reason to investigate further, not proof of infection. If you own the MECOOL KM9PRO Max examined by researchers, consider the warning carefully.
If you have strong reason to believe a device contains malicious firmware, disconnect it from Wi-Fi or unplug it. Ask the manufacturer or retailer whether a verified clean firmware update, replacement or refund is available. Synthient recommends taking affected devices permanently out of use because they may contain other malware as well. Don’t assume a factory reset will fix the problem.
On devices with the Google Play Store, you can check Play Protect certification by opening the Play Store, tapping your profile icon and going to Settings, then About. You can also open Play Protect from the profile menu to review its security scanning. Certification is not a guarantee that a device is malware-free; some products linked to the investigation had passed Google’s checks.
Be wary of streaming devices that promise unlimited premium channels for an unusually low one-time price. The FBI has previously warned about questionable streaming hardware that may arrive with malware or install it during setup. It’s safer to choose manufacturers with a track record of providing security updates, and to avoid downloading streaming apps from unofficial sites or unknown app stores.
Keep your router’s firmware up to date and check its connected-device list for equipment you don’t recognize. If your router supports a separate guest or smart-home network, placing streaming boxes and other connected gadgets there can help limit their access to computers and other sensitive devices. If you find a device you suspect is infected, disconnect it before changing your Wi-Fi password. A new password won’t remove malware already stored in the box.
Some routers also show activity or connection logs. Unexpected data use or unfamiliar connections could be worth checking, though neither proves that a device is infected. A compromised streaming box may show no obvious signs at all.
If you used a potentially compromised device to sign in to streaming services or a Google account, change those passwords from a trusted phone or computer. Turn on two-factor authentication where available, and review account activity for unfamiliar sign-ins. Researchers observed operators collecting sensitive information from some infected devices, so it’s sensible to take those steps.
Security software can help protect computers and phones from malicious downloads and other threats, but it won’t remove a backdoor embedded in a streaming box’s firmware. If the box itself is compromised, disconnecting and replacing it may be the safest option.
Google also warns that services offering payment in exchange for access to your unused internet connection can create security risks. Before installing a bandwidth-sharing or proxy app, find out who can use your connection and what they may do through it.
What stands out is how little a buyer might have had to do to become exposed: purchase a streaming box, connect it at home and start watching. Some affected devices had passed certification checks that consumers may reasonably see as a sign of security. Google’s work to disrupt the operation is welcome, but manufacturers and sellers also have a responsibility to address compromised products. A device can keep playing video normally and still be unsafe to use.
