How to Check if Android TV Box Is Infected
On November 2, 2026, Google announced it had taken down the XCPE botnet, a network of more than 1.3 million Android TV boxes that were infected before they ever left the factory. Google says the box maker Videostrong built the backdoor into its own firmware and sold access to criminals. This guide shows you how to check if your Android TV box is infected, why removing the malware is so hard, and what to do next.
Quick answer: Look up your box’s brand and model. If it’s a Videostrong or MECOOL box, or appears on the list published by the security firm Synthient, assume it’s infected. Technical users can confirm by checking for the apps x.cpe or com.oemservice over ADB. The malware reinstalls itself after deletion, so the safest fix is to replace the box.
What Is the XCPE Botnet?
XCPE is malware hidden in the firmware of cheap Android TV set-top boxes. According to Google, Videostrong deliberately put the backdoor in its devices, then sold access to the infected boxes to criminal groups. Those groups used the boxes as a botnet, a huge network of hijacked devices they could control remotely.
Google worked with Japan’s National Police Agency and several security companies to take down the domains and servers that controlled the botnet. It also banned Videostrong as a partner. Some reports say the takedown may have cut criminal access to about 10 million more compromised devices, many of them not Android, though that figure hasn’t been independently confirmed.
Why the takedown doesn’t make your box safe
This is the part most news stories skip. Google cut off the criminals’ control servers, but the malware is still on every infected box. It lives in a protected part of the firmware called the /oem/ partition. Google’s analysis found that if you uninstall it, it reinstalls itself from that partition the next time the box restarts. If the criminals set up new servers, those boxes could be taken over again.
What can an infected TV box do?
An infected box can be used to route criminals’ internet traffic through your home connection, which makes their activity look like it came from you. It can also download extra malicious modules. Your box sits on the same Wi-Fi network as your phones and laptops, which is why security researchers treat these boxes as a real risk, not just a nuisance.
How to Check if Your Android TV Box Is Infected (5 Steps)
Here’s how to check if your Android TV box is infected, from the easiest checks to the most technical.
Step 1: Find your box’s brand and model
Look at the sticker on the bottom of the box, the original packaging, or your order history on Amazon, AliExpress, or wherever you bought it. On the box itself, you can usually find the model under Settings > Device Preferences > About (the exact menu names vary by brand).
Step 2: Check if it’s a Videostrong or MECOOL box
Videostrong makes boxes sold under the MECOOL brand. Synthient’s research started with a MECOOL KM9 Pro Max. Security coverage advises that if you own a Videostrong or MECOOL device, it’s safest to assume it’s infected. Not every MECOOL model has been confirmed, but there’s no official list that clears any of them.
Step 3: Compare your model with Synthient’s list
Google did not publish a model list. The security firm Synthient, which helped uncover the operation, has published a non-exhaustive list of device model names seen in the botnet. Compare your exact model name with that list.
Keep two things in mind:
- A match is a strong warning, not proof. Cheap boxes often share model names across different makers.
- No match doesn’t mean you’re safe. The list isn’t complete, and many no-name boxes use the same firmware.
Step 4: Look for warning signs
XCPE runs quietly, so you probably won’t notice anything. Still, these are red flags for any cheap Android TV box:
- It came with “free” access to paid channels or movies.
- It isn’t Play Protect certified. Check in the Google Play Store app: open Settings > About and look for “Play Protect certification.”
- Your router shows the box sending data when nobody is using it.
- Your internet provider or a website warns that unusual traffic is coming from your connection.
Note that Videostrong’s own website listed “Google Certified” Android TV devices as of November 2, so a certification claim on the box itself isn’t enough.
Step 5: Confirm with ADB (for technical users)
If you’re comfortable with developer tools, you can check the installed apps directly. Do this on a network separate from your main devices, such as a guest Wi-Fi network.
- On the box, go to Settings > Device Preferences > About and click Build seven times to turn on Developer Options.
- Open Developer Options and turn on USB debugging or Network debugging.
- On your computer, install Android’s free Platform Tools, then connect with
adb connect <box-ip-address>. - Run
adb shell pm list packages -fand look for these package names:x.cpecom.oemservicecom.abc.nexus- Apps pretending to be system services, such as
com.android.system.ntp
- Turn debugging off again when you’re done.
If any of these show up, your box is infected.
What to Do if Your Android TV Box Is Infected
1. Unplug it and take it off your Wi-Fi
Disconnect the box from power and your network right away. If you change your Wi-Fi password later, the box can’t reconnect.
2. Don’t bother uninstalling the app
Deleting com.oemservice won’t help. It comes back from the /oem/ partition when the box restarts. A factory reset doesn’t remove it either, because the reset restores the same infected firmware.
3. Replace the box (recommended)
Synthient advises throwing these boxes away, and other researchers say a real cleanup needs action from the manufacturer or a full replacement. The only other option is flashing custom firmware, if any exists for your exact model. That’s risky, can brick the box, and isn’t worth it for most people.
4. Buy a safe replacement
Stick with streaming devices from major brands that get regular security updates:
- Google TV Streamer
- Amazon Fire TV Stick or Fire TV Cube
- Roku streaming sticks
- Apple TV 4K
- NVIDIA Shield TV
Avoid any box sold as “fully loaded” or with free premium channels.
5. Secure the rest of your network
- Change your Wi-Fi password.
- Update your router’s firmware.
- Run a security scan on computers and phones that shared the network.
- Change passwords for any accounts you signed into on the box, like Netflix or YouTube.
XCPE Botnet: Key Facts
| Detail | What we know |
|---|---|
| Announced | November 2, 2026, by Google |
| Infected devices | More than 1.3 million, mostly Android TV boxes |
| Manufacturer | Videostrong (MECOOL brand), now banned by Google |
| Malware package names | x.cpe, com.oemservice |
| Where it hides | The /oem/ firmware partition |
| Partners in takedown | Japan’s National Police Agency and security firms |
| Still on devices? | Yes. Only the control servers were taken down. |
| Fix | Replace the box, or reflash custom firmware if available |
Frequently Asked Questions
How do I know if my Android TV box is part of the XCPE botnet?
Check whether it’s a Videostrong or MECOOL box, or whether its model appears on Synthient’s list. Technical users can run adb shell pm list packages and look for x.cpe or com.oemservice.
Is my box safe now that Google took down the botnet?
No. Google took down the servers that controlled the botnet, but the malware is still on infected boxes and could be reactivated.
Will a factory reset remove the XCPE malware?
No. The malware is part of the factory firmware, so a reset brings it back.
Are Fire TV, Roku, and Google TV devices affected?
No reports link XCPE to devices from Amazon, Roku, Google, Apple, or NVIDIA. It was found in cheap set-top boxes from Videostrong.
Which brands are affected by the Videostrong backdoor?
MECOOL is the confirmed brand, starting with the MECOOL KM9 Pro Max. Other brands have been mentioned in videos and forums but haven’t been confirmed by Google or Synthient.
Should I throw away my MECOOL box?
Security researchers recommend replacing it. Unplug it now, and don’t reconnect it to your home network.
Final Thoughts
The XCPE takedown is good news, but it didn’t fix a single infected box. If you own a cheap Android TV box, take five minutes to check if your Android TV box is infected using the steps above. If it’s a Videostrong or MECOOL model, unplug it and replace it with a device from a brand that ships regular security updates.
For more coverage, read the full takedown report on BleepingComputer, and see our guide on how to set up Apple HomeView.
Axee Davies is the founder of AxeeTech, publishing gaming guides, codes, and Windows how-tos since March 2013. A tech enthusiast for 13+ years — starting with smartphones and Android rooting — he now runs a site that puts out a new guide every day for Roblox players, traders, and Windows users. More about AxeeTech
