Picture a Saturday afternoon in a café. The TV on the wall plays music videos from a small box labelled "Android TV", bought cheaply two years ago. The box is plugged into the same Wi-Fi as the till laptop and the CCTV cameras. Nobody has opened its settings since the day it was installed. (This scenario is an illustration, not a story from any particular business.)

Now suppose that box came with a back door built in at the factory. That is the core of what Google announced on 2 November 2026. This article is not meant to frighten you. It is meant to show what you can check today.

What Google announced

On 2 November 2026, Google said Videostrong, a maker of certified Android TV devices, deliberately built a backdoor into the firmware of more than 1.3 million set-top boxes and then sold access to criminals. The backdoor is called x.cpe, or com.oemservice in some builds. Google cut ties with Videostrong, banned the company and its future affiliates from making certified Android devices, and took legal action with partners to take down the servers that controlled the botnet.

Google also said the takedown severs criminal access to at least 10 million more devices. Those were infected through other routes and not all of them run Android. They include retail set-top boxes, karaoke machines and telehealth hardware.

Three numbers from Google's 2 November 2026 announcement: 1.3 million TV boxes, more than 10 million other devices, and the announcement date

Why this is not an ordinary virus

Most malware needs you to click something. This one came in the box. The backdoor sits in the firmware and runs with system privileges, so deleting the app solves nothing: when the box restarts, it reinstalls itself from the /oem/ partition. It can also switch off Google Play Protect checks, so other apps can arrive without a prompt.

How did a box like this pass as certified? According to Google, Videostrong disguised its code and only loaded the malicious part after the box was switched on for the first time, so compatibility and security testing never caught it. Google admitted the devices were sold as certified and safe, and called that a failure on its own side.

What its operators could do

Reports from Malwarebytes and BleepingComputer detail what the buyers of that access did. They could install apps silently, run shell commands, take screenshots, inject keystrokes, collect account and device data, map the network, and open a reverse shell, which is a remote way in to the box. To make money, boxes served as exit points for residential proxies and for ad fraud: fake ad views and clicks in the background.

Residential proxying is the part closest to your business. Other people's traffic leaves for the internet through your shop's or café's IP address. Malwarebytes notes that some of that proxy traffic included attempts to guess account passwords, so the owner's IP address could be linked to that activity.

One TV box on a business network with five things its operators could do: install apps, borrow the IP, scout the network, take screenshots, and open remote access

One thing should be said honestly: none of these reports says a till or CCTV system at a particular business was breached through these boxes. Our view is simpler. A device that can map a network and open a remote path should not sit on the same network as the till computer, whatever its brand or certification.

What is done, and what is not

The takedown cut the attackers off from the boxes, but it did not clean the boxes. According to Malwarebytes, the backdoor stays on devices that are already infected and could be used by other criminals. Google has also not published a full list of affected models.

Two columns: what Google has done, cutting servers and banning Videostrong, and what is not finished, the backdoor still sitting in the box

So the good news from Google does not automatically reach the box on your café wall. The cleaning falls to its owner.

Five things to check today

No technical background needed. A phone, an hour, and a willingness to look at the back of the TV.

  1. List every box. TV boxes, sticks, digital menu screens, karaoke machines, and similar internet-connected devices. Coverage of this case says the same backdoor was found on karaoke machines and digital signage, not only TV boxes.
  2. Photograph the brand and model label, then ask the seller. Synthient, a security research firm that took part in the action, compiled a list of potentially affected models, with much of the focus on MECOOL. A model name on the list is not a verdict, and a model missing from it is not necessarily clean, because Google's full list has not come out. Be wary of boxes sold as "free TV".
  3. Separate the network. Put the box and other entertainment devices on a guest Wi-Fi or a network apart from the till and CCTV. Malwarebytes cautions that this protects the other devices, not the box itself.
  4. Unplug the suspicious ones. Disconnect from the internet, then contact the seller or manufacturer for clean firmware or a replacement. Deleting the app is not enough. Synthient even advises throwing the boxes away. If you have an IT vendor, ask them to block mqtt.szbboys[.]com, which BleepingComputer names as the control broker.
  5. Put everything in an asset list. Who bought it, when, which brand and model, which network it connects to. When replacing, choose an established manufacturer, keep Play Protect on, and do not install apps that pay you to share bandwidth.
Five steps to check today: list the boxes, photograph the brand and model, separate the network, unplug the suspicious ones, record everything in an asset list

What is worth remembering

This case is not about one vendor. The boxes reached shop shelves carrying a certified label, and that label proved it could be got past. The practical consequence: a business that knows exactly which devices are on its network can answer "are we affected?" in minutes. A business without a list has to walk around first, and only if it remembers where the boxes are.

If you want to talk through the devices and network at your shop, café or restaurant, message XETUP on WhatsApp at +62 823 1499 5005 for a short consultation. Just tell us what is installed, and we will help decide which to inspect first.