Was your cheap Android TV box secretly using your home internet for someone else?

Google says a botnet called X.CPE was hidden inside more than 1.3 million Android set-top boxes, with a backdoor built into the firmware by maker Videostrong before the boxes were ever sold. Research firm Synthient linked many of the boxes to the MECOOL brand. How to check your own box for Play Protect certification, and what to do if it is not certified.

You plug in a bargain streaming box, the movies play fine, and you never think about it again — while strangers quietly route their internet traffic through your home connection. Short answer: Yes, it could have. On November 2, 2026, a Google-led team announced it had disrupted X.CPE, a botnet hidden inside more than 1.3 million Android set-top boxes in over 200 countries.

Google says the maker, Shenzhen-based Videostrong, built a backdoor into the boxes’ firmware before they were ever sold, and sold access to criminals. Research firm Synthient linked many of the boxes to the MECOOL brand and published a list of 182 affected model names. Why it matters: The hidden software let operators use owners’ home internet connections without permission — for ad fraud, for passing other people’s traffic through the home (a “residential proxy”), and for loading more malware.

Because the backdoor lives in the firmware, owners cannot remove it themselves, and a factory reset does not fix it. Google seized the botnet’s control servers and banned Videostrong from making or supplying certified Android devices.How to check the streaming boxes in your home:1. Check the brand and model of any cheap streaming box in your home, especially no-name boxes and MECOOL-branded ones.2.

Check Play Protect certification: open the Google Play Store on the box, tap the profile icon, then Settings, then About, and look for “Play Protect certification” — it should say the device is certified.3. If the box is uncertified or on an affected-model list, stop using it on your main network — unplug it and replace it with a certified streaming stick or box from a known maker (our best streaming stick guide can help you pick one).4. Put streaming gadgets and other smart-home gear on your router’s guest Wi-Fi network, separate from your phones and computers.5.

Buy certified next time: look for the Google TV / Android TV partner branding and Play Protect certification on the box before you pay.Pro tip: A box advertised as “fully loaded” with free everything, or sold pre-rooted, is a red flag, not a bargain.Ad’s take: A streaming box that costs less than a pizza can end up costing you your privacy. I’d rather pay a little more once for a certified stick from a name I know than wonder who else is using my internet.