Thousands of Android TV boxes sold into South Africa left the factory with a backdoor already installed. Google and its partners have cut the command infrastructure, but the malware is still on the devices.
What happened
Google's Threat Intelligence Group attributed the X.CPE network to Shenzhen manufacturer Videostrong Technology, which it says built the backdoor into device firmware and sold access to criminal affiliates. TrendAI counted 41,651 affected devices in South Africa between June and October 2026, part of a botnet of more than 1.3 million devices across 200-plus countries. The malware activated after first boot to slip past certification testing, and operators used the boxes for residential proxying and ad fraud. Google took legal action against the control domains, revoked Videostrong's certification and banned it from building certified Android devices, working with Lumen, HUMAN Security, Plume, Synthient, TrendAI and Japan's National Police Agency.
Who is affected
Anyone running a cheap Android set-top box, and any business that bought one for a screen.
- Households and small offices using unbranded or lesser-known Android TV boxes for streaming
- Businesses using Android boxes for digital signage, waiting-room screens or hospitality TVs
- ISPs and managed service providers whose clients' public IP addresses were used as proxy exits
What to do now
Treat an affected box as compromised hardware and replace it, because a factory reset does not remove firmware-level malware.
- Inventory every Android TV box on client sites and match the model against Synthient's published list of affected model names
- Disconnect and replace any matching unit rather than resetting it
- Put signage and guest-streaming devices on a separate VLAN with no route to file shares or management interfaces
- Check firewall logs for unexpected outbound traffic from those segments, and watch for ad-fraud or proxy complaints against client IPs
What this means for South African businesses
The takedown stopped the operators talking to the devices; it did not clean them, and the same supply chain will rebuild under other brand names. For a South African SME the practical risk is not the TV content, it is that a R900 box on the guest network was routing someone else's malicious traffic out of the company's public IP address. In my view the exposure sits mostly with hospitality, retail and signage deployments, where these boxes are bought in bulk and never appear on an asset register.
Source
The South African device count and the takedown detail are reported by Gadget, drawing on TrendAI research and Google's threat intelligence blog.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.