XCPE backdoor in cheap Android TV boxes: what offices should do

MyCERT, Malaysia's computer emergency team, issued a grade A advisory on 12 Nov 2026 about XCPE, a backdoor built into some low-cost Android TV boxes and Android devices at the factory. A factory reset does not remove it. If your office, shop or home uses a no-name TV box, check it, move it to a guest network and plan to replace it.

What is XCPE?

XCPE is a hidden program inside the device firmware, the base software that comes with the box. It runs from the first time the box is switched on. MyCERT explains that it sits in a protected part of the firmware, so it comes back after you uninstall it or reset the box.

Google's threat team says the people behind it sold access to the infected boxes. Other criminal groups then used them for ad fraud, ran hidden ads and clicks, and turned the owner's internet line into a "residential proxy", so strangers' traffic goes out through your connection. Google also says the backdoor could install apps silently, switch off Google Play Protect, take screenshots and send out account details.

How big is it, and was it stopped?

Google's threat team says more than 1.3 million set-top boxes were enrolled in the XCPE botnet. It says, with high confidence, that the Shenzhen device maker Videostrong Technology Co. built and ran the backdoor for profit, and that Google has banned the company from making certified Android devices.

Google and partners, including Japan's National Police Agency, took down the main control servers in late October 2026. MyCERT notes that this did not end the problem: some of the partner networks were still running on 10 Nov, and infected boxes still carry the backdoor.

Who is affected in Malaysia?

MyCERT says cheap, grey-import Android TV boxes are common in Malaysian homes and small businesses, and are often used for digital signage. In one count from June to October 2026, quoted by MyCERT, Malaysia had more infected devices than any other country. NACSA, the National Cyber Security Agency, warned the public about XCPE on 8 and 9 Nov.

Most infected devices are Android TV boxes. Google also found it on digital signage screens, karaoke machines and some health devices. A brand or model name alone does not prove a box is infected.

What to do

1. Make a list. Walk around the office or shop and note every Android box: the TV at reception, the promotion screen at the counter, the karaoke set, any box plugged into a TV next to the CCTV recorder. Unbranded boxes sold "fully loaded" with free channels are the ones to look at first.
2. Check the box. MyCERT says to open Settings, then Apps, then show system apps. If you see x.cpe, com.oemservice or com.abc.nexus, treat the box as infected.
3. Unplug an infected box. Take it off the Wi-Fi and the network cable. A factory reset will not clean it.
4. Replace it. Buy from a known brand and an authorised seller. Google keeps a list of certified Android TV partners, and a Google TV or certified Android TV device is the safer choice.
5. Keep TV boxes away from work machines. Put any TV box, smart TV or signage player on a guest Wi-Fi, separate from office PCs, the accounts computer, the NAS and the CCTV recorder. Most office routers have a guest network option.
6. Change passwords. If a Google, YouTube or streaming account was signed in on an infected box, change its password from another device and turn on two-step login.
7. Look at the router if you can. A box that uses a lot of internet even when nobody is watching is worth checking. Your IT person can review the router's traffic per device.
8. Tell staff and family. Many people bring the same cheap boxes home. Share this post with them, and warn them about apps that pay you to "share unused internet", which MyCERT and Google both say feed the same proxy networks.

If your office internet line ever lands on a blocklist or your email starts bouncing for no clear reason, an infected box on the same line is one thing to rule out.

If you are not sure what is plugged into your office network, ask whoever looks after your IT, or email support@synctech.com.my with your question.

Source and credit

We are sharing this news from MyCERT and Google Threat Intelligence Group. This summary is written by Synctech in our own words.

• MA-1507.112026: MyCERT Advisory - Pre-installed XCPE Firmware Backdoor and Botnet Targeting Android TV Boxes and IoT Devices, MyCERT, 12 Nov 2026: https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=ab684a67-411e-4e66-bf06-d0dcbd4a2e31
• Shutting the Door on the XCPE Botnet, Google Threat Intelligence Group, 3 Nov 2026: https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet Retrieved 12 Nov 2026. Android, Android TV, Google TV, Google Play Protect and YouTube are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.