A small box under the television turns it into a smart TV, and millions of people bought one because it was cheap. In the case of one manufacturer, the box also came with a hidden entrance that the company sold to criminals — and that entrance is still there.
What actually happened
On 2 November, Google’s threat researchers published what they found inside a network of infected devices they call XCPE. More than 1.3 million set-top boxes — the small boxes that stream films and apps onto a television — were part of it.
Google says it is highly confident the hidden software was built and run on purpose by Videostrong, a device maker in Shenzhen, China that builds boxes under its own name and for other brands. The researchers found no sign of a mistake or one dishonest employee.
The hidden entrance was built into the software that ships with each box, and access to it was sold to criminal groups, who loaded their own programs onto the devices. Last week Google took legal action to shut down the servers that ran the network, and banned Videostrong from making certified Android devices at all.
What the secret entrance could do
The hidden program sat in the part of the box’s software that owners cannot reach. Google says that if someone manages to delete it, it puts itself back the next time the box is switched on.
Once running, it could install apps without asking, run commands, photograph whatever was on the screen, and map the home network the box was connected to. Google’s researchers watched operators take live screenshots and type into boxes from far away. One investigation found the box also sending the owner’s email address to the operators, if that person had signed in.
It could switch off Play Protect as well — the built-in protection on Android devices that checks apps for harm — so more dangerous software could be installed without being stopped.
Why this matters to you, even if the box seemed fine
Most of what was loaded onto these boxes turned them into a relay for somebody else’s internet traffic. Companies sell that access to whoever pays, so the traffic looks like it comes from an ordinary household — in this case, the person who bought the box.
That is the part worth sitting with. Someone else’s activity on the internet may have carried your home address with it, and you would never have seen a thing on your television.
Other programs faked views of online adverts, so advertisers paid for audiences that were never really there. Researchers at the security firm Synthient, who took one of these boxes apart, say infected devices turned up in Malaysia, Mexico and Brazil, and also in the United States, China and Germany.
What you can actually do
There is no update that removes this. The researchers who studied the devices say owners should stop using them, and here is what that looks like in practice.
- Work out what you own. Look at the name on the box and the remote. Devices sold as MECOOL and YOKATV are named in the research, as are cheap boxes from marketplaces and boxes that arrived with apps for films you would normally pay for.
- Unplug it from the television and from the power. A box that is not connected cannot be told what to do.
- Sign out of anything you signed in to on that box, then change those passwords and turn on two-step verification. Start with your email, because an email account can be used to reset the others.
- Block it in your router. The app that came with your internet router usually shows every device in your home and lets you block one. That cuts the box off without disturbing anything else.
- Do not sell it or give it away. The researchers’ advice is to dispose of these devices, because they may hold more than one piece of unwanted software.
Common misunderstandings
Myth: if the box still works, nothing is wrong
A box that works normally is exactly what the operators wanted. Nothing about this shows up on screen: the films play, the menus open, the little light comes on. The stolen work happened quietly in the background.
Myth: I can just uninstall it or reset the box
You cannot, and a factory reset does not reach it. The hidden program lives in a protected part of the software and reinstalls itself when the device starts. That is why the advice is to stop using the device, not to clean it.
Myth: the word ‘certified’ means it is safe
These were certified Android TV devices, sold with Google’s apps preloaded. Google says the manufacturer hid its code well enough to get past testing and loaded it only after the box was first switched on, and it has since changed how it checks certified devices. A brand you know still narrows the field, but it is not a guarantee.
What to watch for next
This is not a first. Google took legal action against a similar network called BadBox 2.0 in July 2025, and that one involved more than 10 million devices that had never been certified at all.
Expect the pattern to repeat: very cheap boxes, unfamiliar brand names, and the promise of every film for free. Google says these groups swap tools quickly once part of their setup is closed, and that shutting these servers also cut off at least 10 million other infected devices.
The one thing to remember
Hardware that sells for very little has to be paid for somehow. When a box offers everything for free, the thing being sold may be your internet connection.
Image: “Android TV-based Tracer set top box” by Oliwier Jaszczyszyn of kontrabanda.net, licensed CC BY-SA 4.0, via Wikimedia Commons.