A major Android TV box maker just got busted by Google for running a malware racket

Affiliate links on Android Authority may earn us a commission. Learn more.

A major Android TV box maker just got busted by Google for running a malware racket

Nov 3, 2026 — 1:53 AM ET

- Google has cut ties with the company behind MECOOL Android TV boxes after the company allegedly installed malware on these devices.

- The TV box maker reportedly installed a backdoor on its products and then sold access to these boxes, enabling ad fraud and the exfiltration of sensitive info.

- Google says it’s also made changes to its device review program to plug gaps in the process.

There’s no shortage of Android TV box makers, with brands like Google, Walmart Onn, Xiaomi, NVIDIA, and others all offering devices. Another notable brand is MECOOL, which offers budget-tier TV boxes on Amazon, AliExpress, and a variety of other platforms. However, it turns out that MECOOL apparently used its TV boxes to engage in nefarious activities.

Google said it and industry partners dismantled the so-called XCPE backdoor that turned over 1.3 million Android TV boxes into a botnet. The likely culprit wasn’t some arbitrary criminal group, either, but the company behind MECOOL TV boxes.

Have you heard of MECOOL TV boxes before?

“We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co., an Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM),” Google explained in a company blog post.

The company also elaborated on how this backdoor was used:

Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices. These secondary modules were conducting ad-fraud; silently enrolling infected devices into residential proxy networks; and loading additional malware onto XCPE-compromised devices.

Furthermore, the company said it observed Videostrong operators performing other sensitive actions on infected devices. These actions include capturing screenshots, injecting key strokes, exfiltrating sensitive information (e.g., account info, package inventories, system logs), and executing shell scripts and commands.

Google found this malware in many different TV box models and brands over the years, complete with dedicated infrastructure and “constantly evolving configurations” to evade detection and manage affiliates. It also published a map of the malware’s distribution, including markets like Australia, Brazil, Indonesia, Mexico, Russia, South Africa, Spain, Turkey, the UK, and the US.

The search giant refuted any potential suggestions that this was an accident or isolated incident:

We believe this campaign wasn’t an isolated rogue insider or a development oversight. As a result, Google has cut ties with Videostrong and banned them from making devices with preloaded Google apps.

Google also admitted that Videostrong used “obfuscation techniques” to exploit a gap in its device security tests, allowing the TV box maker to load malware after the first boot. The search giant said it has since made changes to clamp down on this gap in its review process.

The company adds that while the “overwhelming majority” of infected devices were Android TV boxes, it also uncovered infected Android-based IoT products like karaoke machines, telehealth devices, and digital signage gadgets.

Either way, I’d strongly urge you to wipe your MECOOL device and stop using it. There’s no shortage of alternative options, such as the Google TV Streamer series, the Walmart Onn range, and the Xiaomi TV box line. But it’s still disappointing to have to buy another TV box because the maker of your current box installed malware on it.

We’ve nevertheless asked MECOOL for comment regarding this saga and will update our article accordingly as soon as the company responds to our query.