Google Shuts Down Android TV Malware Network – MECOOL Users Beware!

For years, TROYPOINT has tested, reviewed, and recommended various Android TV boxes to help you get the most out of your home entertainment setup. In the past, we have highlighted devices from MECOOL (such as the KM9PRO and KM7 Plus) as capable, budget-friendly streaming options. Unfortunately, we have a major security update to share regarding this brand.

Google has officially taken action against a massive malware operation—known as the XCPE botnet—that was intentionally built directly into the firmware of over 1.3 million Android TV boxes, specifically identifying MECOOL devices and their manufacturer, Videostrong Technology Co.

This article explains what happened and provides suggestions on what to do if you own one of these compromised Android TV Boxes.  Yes, you can replace the firmware through a tutorial I’ve already created.

The Google Takedown: What Happened?

On November 2, 2026, Google’s Threat Intelligence Group, in coordination with international police and cybersecurity firms, announced the successful disruption of a massive malware network. According to the report, Videostrong intentionally snuck a backdoor into their certified Android TV devices before shipping them to consumers.

This backdoor allowed criminal organizations to silently use owners’ home internet connections for massive ad fraud schemes and proxy networking. To make matters worse, the backdoor was designed to actively disable Google Play Protect’s security checks, leaving the devices open for criminals to install secondary apps, capture screens, and monitor home networks completely undetected.

MECOOL is No Longer Distributing Android TV Boxes

Because of this severe breach of trust, Google has permanently severed ties with Videostrong. The tech giant has officially revoked their license to manufacture Android TV devices with preloaded Google apps and services.

Furthermore, Google has explicitly banned Videostrong (and any of its future affiliates or subsidiaries) from producing certified Android devices ever again. If you were waiting on a new MECOOL device or hoping for a firmware update to fix the issue, it isn’t coming. MECOOL’s run as a certified Google TV distributor is over.

While the streaming hardware market is notoriously competitive, MECOOL did not slowly bow out of the industry; their exit was immediate and forced. Right up until this security takedown, the manufacturer was actively producing and marketing new Android TV devices, but Google’s permanent, network-wide ban has instantly and permanently stripped their ability to distribute certified hardware ever again.

Why Your MECOOL Box is NOT Safe to Keep Using

While Google successfully shut down the command-and-control servers that criminals were using to send orders to these boxes, your MECOOL device is still not safe to use unless you flash a new firmware onto it (more info on this below).

Cybersecurity researchers at McAfee and other firms have confirmed that the backdoor (often hidden in system files like x.cpe or com.oemservice) is baked directly into the device’s protected firmware. Here is why you must stop using the device:

• Factory Resets Won’t Work: Because the malicious code lives in the protected firmware, performing a factory data reset will not remove the backdoor. It will simply reinstall itself.
• Future Exploits: Even though the current criminal servers are dead, the open backdoor means your device remains vulnerable if a new server network is spun up by bad actors.
• Compromised Network: Keeping the device connected to your Wi-Fi puts your other household devices and personal data at risk.

Are Both “Certified” and AOSP MECOOL Boxes Affected?

A common question among cord-cutters is whether this threat only applies to cheap, uncertified (AOSP) Android boxes, or if Google-certified MECOOL devices are impacted too. The answer is extremely concerning: you must assume ALL MECOOL Android TV boxes—both certified and AOSP—are compromised. Because the manufacturer, Videostrong, intentionally baked the XCPE backdoor directly into their firmware during the manufacturing process before they ever left the factory, their entire supply chain was tainted. This was not a rogue software update or an accident; it was a deliberate, top-down integration. Whether your MECOOL box has “official” Google licensing or is an uncertified AOSP model, any factory-installed operating system from this manufacturer carries an unacceptable risk and should be considered compromised unless you completely wipe it and flash a clean, third-party ROM.

It’s Not Just MECOOL: Over 180 Other Models Affected

While MECOOL is the most recognizable brand caught in this takedown, they are far from the only ones affected. Videostrong, the manufacturer behind the malware, operates as a massive Original Equipment Manufacturer (OEM). This means they build the hardware and write the firmware for dozens of other companies who simply slap their own brand name on the plastic casing.

According to the cybersecurity firm Synthient—who assisted Google in tracking down the botnet—the malicious backdoor has been spotted on 182 different device models. Many of these are cheap, “white-label” Android TV boxes sold by unrecognizable third-party sellers on Amazon, eBay, and AliExpress.

The TROYPOINT Rule of Thumb: If you purchased a generic, off-brand Android TV box (especially ones advertised as “unlocked” or “fully loaded” for free TV), there is a high probability it was manufactured in a compromised facility like Videostrong’s. Unless you are using a trusted, name-brand device (like onn., Google, NVIDIA, BuzzTV, Formuler, Ugoos) or have flashed a custom ROM like Slimbox, your home network could be at risk.

What Android TV Brands Are Actually Safe?

With MECOOL and dozens of generic brands compromised by the Videostrong takedown, you are likely wondering what devices are actually safe to connect to your home network. Fortunately, there are several premium manufacturers that utilize entirely separate, secure supply chains and dedicated firmware development teams.

If you are looking to replace your compromised MECOOL box, these brands are safe, highly recommended alternatives that we routinely test and recommend here at TROYPOINT:

• BuzzTV: A fantastic alternative that offers both fully certified Google TV devices (like the newer G-Series running Android 14) and powerful, clean AOSP devices (like the Classic AI). They use trusted manufacturing partners and dedicated software teams completely separate from the malware scandal.
• Formuler: Formuler builds premium, enthusiast-grade hardware (such as the Z12 Ultra) centered around their proprietary MYTVOnline software. They manage their own secure ecosystem and have zero ties to the cheap, mass-produced generic box market.
• Ugoos: For advanced users who prefer pure AOSP, Ugoos (like the AM9 Pro) remains a top-tier choice. Unlike fly-by-night brands, Ugoos is its own manufacturer with a stellar reputation for providing clean, highly optimized firmware with frequent, legitimate security updates.
• Mainstream Certified Devices: Devices built by major tech companies or Tier-1 ODMs—such as the Walmart Onn 4K Pro, NVIDIA Shield TV Pro, Google TV Streamer — are always safe bets, as they undergo rigorous, uncompromised security auditing.

If you’re looking for a new Android TV Box here are our suggestions.

Best Android TV Boxes

What You Need to Do Right Now

If you currently own a MECOOL box, or any unbranded Android TV box manufactured by Videostrong, you need to take immediate action to protect your home network:

1. Unplug the Device: Disconnect the box from your TV and unplug the power immediately.
2. Disconnect from Wi-Fi/Ethernet: Ensure the device can no longer access your internet connection to prevent it from acting as a proxy.
3. Change Your Passwords: If you logged into streaming services, Google accounts, or used payment methods on the affected box, change those passwords immediately from a secure computer or smartphone.
4. Replace the Box: If you don’t want to flash the firmware with my guide linked below you should replace the box.

A Lifeline for Advanced Users: Flashing Custom Firmware

If you don’t want to throw your MECOOL hardware in the trash, there is one highly effective way to salvage the device: completely erasing the infected operating system and replacing it with custom firmware. Because the malware is tied directly to MECOOL’s stock firmware, wiping the internal storage and flashing a clean, third-party ROM will completely overwrite the compromised system files and eliminate the backdoor.

For those willing to get their hands dirty, we have a complete, step-by-step guide on How to Install SlimboxTV Firmware. SlimboxTV fully supports most MECOOL models and replaces the infected software with a clean, fast, and debloated Android TV experience.

Note: Flashing custom firmware removes the official Google certification for boxes that include it. While this keeps your network safe and gives you a fantastic, highly customizable streaming device, premium apps that require Widevine L1 certification (like Netflix and Amazon Prime Video) may no longer stream in 4K. For many cord-cutters, however, this is a small price to pay to secure their network and save a perfectly good piece of hardware.