Millions of people use Android TV boxes to stream movies and watch their favourite shows. However, some of these devices may be doing something far more dangerous in the background. Google has uncovered a large cybercrime network involving more than 1.3 million internet-connected devices, allegedly linked to Chinese manufacturer VideoStrong Technology.
The company is accused of pre-installing malicious software on TV boxes and making those devices available to hackers. The malware, identified as XCPE, reportedly allowed criminals to remotely control infected devices without the owners’ knowledge.
According to a November 2 report from Google’s Threat Intelligence Group, the malware was discovered in devices sold under several brands over a period of years. Google has responded by banning VideoStrong from manufacturing certified Android devices and supplying software to other certified manufacturers.
The investigation was conducted with support from Japan’s National Police Agency and cybersecurity companies, including Lumen, HUMAN Security, Synthient and TrendAI.
How Google Discovered the XCPE Malware
Google’s investigation found that the malicious software was embedded directly into certain devices, giving attackers the ability to control them remotely. Once compromised, a device could secretly download and install applications, take screenshots, collect information and redirect internet traffic through the owner’s home connection.
Google said it did not believe the operation was simply the result of an individual employee acting alone or an accidental development mistake.
Researchers at Synthient helped identify a possible connection to VideoStrong after investigating an infected MECOOL TV box. Their analysis uncovered company-related documents and links between VideoStrong’s infrastructure and the servers used to manage the malware.
Why Android TV Boxes Can Be Attractive to Hackers
Smart TVs and streaming devices are widely used in homes, making them valuable targets for cybercriminals. Many remain connected to the internet for long periods, while their security updates may be irregular. Users also tend to pay less attention to the security of these devices than they do to smartphones or computers.
This combination can allow malicious software to operate in the background without attracting attention.
Depending on how the infected device is being used, hackers may be able to:
- Generate fake advertising views to earn money through fraudulent activity.
- Send internet traffic through a user’s connection, making another person’s online activity appear to come from that household.
- Collect device information and potentially expose personal or account details.
- Install additional malicious software and increase their control over the device.
Google Takes Action Against the Malware Network
Google has taken legal action to shut down servers used to control XCPE and several related malware operations. The company estimates that disrupting this infrastructure could prevent criminals from accessing at least 10 million more compromised devices.
However, shutting down the command servers does not necessarily remove malicious software already installed on affected TV boxes. The code may remain on a device even after its connection to the hackers’ infrastructure has been interrupted.
How to Check Whether Your Android TV Box Is at Risk
Google has not released a complete list of affected models for consumers. Owners of suspicious or uncertified Android TV boxes should check the device manufacturer’s details and install firmware updates only from trusted sources. They should also avoid downloading applications from unfamiliar websites or unverified sources.
If a device is confirmed to be infected, disconnecting it from the internet is the safest immediate precaution. A factory reset may not be enough if the malware is embedded in the device’s system software.
The discovery is a reminder that internet-connected entertainment devices can pose security risks beyond ordinary streaming. A TV box that appears to be working normally could potentially be carrying out hidden activities without its owner’s knowledge.
Disclaimer: This article is intended for general news and information purposes only. The security risks and recommendations mentioned above are based on the information available in the cited report. Device owners should follow official manufacturer and cybersecurity guidance when checking or addressing a suspected infection.