'CyberGuy' warns of creepy privacy clauses in smart devices
Kurt "CyberGuy" Knutsson warned of worrying privacy clauses in smart devices in a recent episode of the "Beyond Connected" podcast.
You buy a streaming box, plug it into your television and connect it to Wi-Fi. A few minutes later, you're watching your favorite show. Everything seems perfectly normal. But what if that little box has been secretly working for criminals since the day you brought it home?
That's the alarming discovery behind a massive Android TV box malware operation involving more than 1.3 million devices worldwide. According to a Nov. 2 report from Google's Threat Intelligence Group, investigators concluded with high confidence that a device manufacturer deliberately installed hidden software inside streaming hardware. That backdoor gave outsiders remote access without the owners knowing.
And here's what makes this particularly concerning. The malware was built directly into the devices, and some affected products made it through Google's own security certification process. In other words, buyers could do everything right and still end up with compromised hardware.
Missed CyberGuy LIVE? Watch the replay and discover 5 ways to travel smarter and save money.
Our free CyberGuy LIVE class, 5 Ways to Travel Smarter and Save Money, has ended, but you can still watch the full replay. Kurt "CyberGuy" Knutsson walks you through five practical ways to protect your phone and personal information, avoid common travel scams, find better deals, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.
Watch the free replay + downloadable checklist now at CyberGuyLive.com.
CHEAP ANDROID PHONES FOUND WITH MALWARE ALREADY INSTALLED
Researchers discovered preinstalled malware in a MECOOL KM9PRO Max streaming box, allowing criminals to access the device without the owner's knowledge. (MECOOL)
Google uncovers malware hiding inside Android TV boxes
Google says the operation involved Videostrong Technology, a China-based company that manufactures Android-powered devices for different brands. According to investigators, Videostrong developed and installed malicious software called XCPE. Google assesses with high confidence that the company deliberately operated the backdoor for financial gain. The software allowed remote operators to maintain access to devices long after customers purchased them.
According to Google, Videostrong sold access to compromised devices to criminal affiliates, who installed additional malware and turned those products into part of a botnet. That's a network of infected devices controlled remotely without their owners' permission. Researchers identified more than 1.3 million affected devices across the globe. Most were Android TV streaming boxes, although the operation also reached other types of connected hardware. And many people using these products had no idea anything was wrong.
What criminals were doing with infected streaming boxes
While people were watching television, hidden software could be working behind the scenes for someone else. One of the biggest operations involved residential proxy networks. These services allow someone to route their internet activity through another person's home connection. That means a criminal could use your internet address to make suspicious online activity appear to originate from your household.
Think about that for a moment. Someone you've never encountered could be using your internet connection without your permission, while your streaming box continues playing Netflix or YouTube. Google also found malware capable of generating fake advertising activity. Some modules secretly loaded ads or simulated interactions to generate revenue for the operators.
Other capabilities were more invasive. Researchers observed operators capturing screenshots, injecting keystrokes and collecting sensitive account information from compromised devices. They could also install additional software remotely. And because much of this activity happened in the background, users might never see an obvious warning.
5 WORRISOME PRIVACY CLAUSES HIDDEN IN SMART HOME DEVICES
Google's diagram shows how the XCPE backdoor connected infected Android TV boxes to remote servers that could install additional malware and control devices. (Google Threat Intelligence Group)
How the Android TV malware bypassed Google's security
Normally, manufacturers must pass Google's compatibility and security checks before shipping certified Android devices with Google's services. However, Google says Videostrong found a way around those protections. The company allegedly concealed malicious software during testing. The backdoor then loaded additional malicious code after the device's first startup, exploiting a gap in Google's review process.
Even more concerning, the malware could disable Google Play Protect app verification. That's one of Android's built-in defenses against harmful applications. The backdoor also had staying power. Researchers discovered that XCPE was embedded in the device's firmware, the software responsible for basic hardware operations. If someone removed the visible malware package, the system could reinstall it after a reboot. So even a factory reset might leave the underlying infection intact.
Which Android TV boxes are affected?
This is probably the first question people will ask after hearing about this investigation. Unfortunately, Google has not released a complete consumer-friendly list of every infected retail product. However, cybersecurity company Synthient published its own investigation identifying specific hardware and model names connected to the operation.
Confirmed infected streaming box
Researchers purchased and examined a MECOOL KM9PRO Max Android TV streaming box in late 2025. They found the XCPE backdoor preinstalled under the package name com.oemservice. The tested device used firmware version C1.0.8_20250325, according to Synthient's technical documentation. This identifies the specific research sample, although it does not establish that every unit running that version is infected.
Other device models identified by researchers
Synthient also published model identifiers observed in the wider botnet. These include KM9PRO_MAX, KM9PRO, KM2PLUSDELUXE, KM2PLUS, KM7PLUS, KT1, IPx1, IPx3, Q96MAX and TX3MINI. These identifiers appeared in data associated with the malicious operation. However, researchers explicitly warn that a matching model name alone cannot confirm that an individual device is compromised. You can review Synthient's published device model list at github.com/synthient/public-research/blob/main/2026/11/Videostrong/README.md to compare it with your own hardware.
The investigation also identified infections in Android-powered karaoke machines, digital signage equipment and some telehealth devices. Google says the malware appeared across many models and brands over several years. And that's why checking the exact product you own is so important. The retail brand on the box may differ from the company responsible for manufacturing its hardware or firmware.
Google shuts down the XCPE botnet and bans manufacturer
Google worked with Japan's National Police Agency and several cybersecurity companies to dismantle the XCPE operation. Google took legal action to shut down the domains and servers Videostrong used to control infected devices and install malware. The company also pursued legal action against command-and-control domains associated with more than a dozen additional malware families. According to Google, those additional actions were expected to sever criminal access to at least 10 million other compromised devices. That estimate involves malware networks beyond the 1.3 million devices identified in the XCPE operation.
Google also cut ties with Videostrong and banned the company, along with future subsidiaries and affiliates, from building or selling certified Android devices or supplying software to other certified vendors. The company says it has also strengthened its security review process to better detect similar threats, including improvements to how it verifies the integrity of firmware on certified Android TV devices. That's encouraging news, but there's an important catch. Disrupting the servers used to control malware doesn't automatically remove malicious firmware from devices already sitting in people's homes. For owners of affected hardware, that leaves an important question about whether their devices can ever be trusted again.
Google's investigation uncovered more than 1.3 million compromised devices worldwide, revealing how widely the XCPE malware operation had spread. (Google Threat Intelligence Group)
How to protect yourself from Android TV box malware
Now, before you start unplugging every streaming device in your house, understand that Google has not suggested every Android TV or Google TV product is compromised. However, this investigation offers a good reason to take a closer look at the equipment connected to your home network.
1) Check your streaming box's brand and model
Start by identifying the exact make and model of your streaming device. Look on the underside of the box, its original packaging or the device information screen in Settings. Compare that information with Synthient's list of observed models. If your device matches a listed model, investigate further. Remember, a model match alone does not confirm an infection. If you own the MECOOL KM9PRO Max examined by researchers, take the warning seriously and consider replacing it.
2) Disconnect a device you believe is infected
If you have strong reason to suspect your streaming box contains malicious firmware, disconnect it from Wi-Fi or unplug it entirely. Contact the manufacturer or retailer about a verified clean firmware update, replacement or refund. Synthient recommends permanently removing affected devices from use because they may contain additional malware. Don't assume a factory reset will solve the problem. The XCPE backdoor was designed to reinstall itself.
3) Check Google Play Protect certification
On devices with the Google Play Store, open the Play Store, tap your profile icon and select Settings > About to check the Play Protect certification status. You can also open Play Protect from your profile menu to review security scanning. However, certification alone cannot guarantee a device is free of malware. Some devices associated with this investigation passed Google's certification checks. A certified label offers an additional layer of reassurance, but it cannot guarantee that a device is free of malware.
4) Avoid suspicious streaming apps and cheap TV boxes
Be cautious about streaming products promising unlimited premium channels or paid entertainment for a suspiciously low one-time price. The FBI has previously warned about questionable streaming hardware that arrives with malware or installs it during setup. Stick with reputable manufacturers that provide regular security updates. Also, avoid installing streaming applications from unofficial websites or unknown app marketplaces.
5) Keep your home router updated and secure
Your router connects your streaming equipment to the rest of your home network. Make sure its firmware is current and review the list of connected devices for unfamiliar equipment. If your router supports a separate guest or smart-home network, consider placing streaming boxes and other connected gadgets there. That can help limit their access to your personal computers and other sensitive devices. If you discover an infected device, disconnect it before changing your Wi-Fi password. A password change alone will not remove malware already embedded in the box.
6) Watch for unusual internet activity
Check your router's activity logs or connected-device information if those features are available. Unexplained bandwidth consumption or unfamiliar network connections can be warning signs, although they do not prove a device has malware. Keep in mind that an infected streaming box may show no obvious symptoms. Normal performance doesn't guarantee that the hardware is secure.
7) Protect accounts connected to your streaming device
If you've signed into streaming services or a Google account on a device you believe was compromised, change those passwords using a trusted computer or phone. Enable two-factor authentication (2FA) where available. Also, review your account activity for unfamiliar sign-ins. Google observed operators collecting sensitive information from compromised devices, so protecting those accounts is a sensible precaution.
8) Use strong antivirus protection on compatible devices
Strong antivirus software can help protect your computers and smartphones from malicious downloads and other threats. Keep those protections enabled, especially when dealing with unfamiliar applications. However, traditional antivirus software on your computer won't remove a backdoor embedded in a streaming box's firmware. If the box itself is compromised, disconnecting and replacing it may be the safest solution. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com
9) Be careful with apps that pay you to share internet bandwidth
Some services offer compensation in exchange for allowing others to use your unused internet connection. Google specifically warns that these arrangements can expose devices and home networks to additional security risks. Before installing any bandwidth-sharing or proxy application, understand exactly who can access your connection and what activity they may conduct through it.
Kurt's key takeaways
What really gets my attention about this investigation is how little someone would have needed to do to become a victim. You could buy a streaming box from an online retailer, connect it to your television and end up with malware that was already installed before you opened the package. And there's another part of this story I find particularly frustrating. Some affected devices made it through Google's certification process. People rely on those certifications because they assume someone has checked the hardware for security problems. In this case, that trust was exploited. Google deserves credit for working with investigators to disrupt the operation. But I think the bigger responsibility starts with manufacturers and the companies selling these products. If a company puts compromised hardware into someone's home, it should be held accountable for fixing the problem. For me, the takeaway is pretty simple. Know what you're connecting to your home network. Stick with brands that have a solid record of security updates. And if researchers confirm that a streaming box contains malicious firmware, I wouldn't keep using it simply because the picture on the television still looks fine.
If a streaming box can pass Google's security checks and still arrive with hidden malware, should manufacturers be required to recall compromised devices and compensate customers? Let us know by writing to us at Cyberguy.com
Sign up for my FREE CyberGuy Newsletter
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com - trusted by millions who watch CyberGuy on TV daily.
- Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Copyright 2026 CyberGuy.com. All rights reserved.
