DEVICE SECURITY
Tested: No XCPe Backdoor Found on Our HK1 X50
In November 2026, Google shut down a botnet of about 1.3 million Android TV boxes that shipped with a hidden backdoor called XCPe. We tested the HK1 X50 we sell. Here’s what we found, and how to keep your box safe when you sideload apps.
On This Page
- Test Results
- What This Means for You
- Before You Sideload a Risky App
- Add a VPN for Privacy
- Warning Signs & What to Do
Test Results
No trace of the XCPe backdoor was found on the HK1 X50. No signs of the other well-known TV-box malware (Vo1d and BadBox) were found either.
What is XCPe? It’s a hidden program called x.cpe, built into boxes at the factory by the Chinese manufacturer Videostrong (maker of MECOOL boxes). It let criminals control infected boxes remotely, mostly to resell owners’ internet connections and fake ad views. The reports linked it to Videostrong and MECOOL devices; HK1 was not named.
We inspected a new HK1 X50 (Amlogic S905X5M, Android 14, latest firmware) directly over a computer connection, checking every installed app, running program and network connection against the published warning signs.
| What we checked | Result |
|---|---|
| XCPe backdoor and its known helper apps | Not found |
| Made by Videostrong / MECOOL | No |
| Vo1d malware files | Not found |
| BadBox-style hidden apps | Not found |
| Connections to unknown servers | None – only normal Google services |
| Firmware | Up to date |
Tested in-house by Everything Streaming on 6 November 2026. Results apply to the HK1 X50 on its current firmware. Older HK1 X5 (S905X4) boxes are being tested next, and this page will be updated. No test can prove a device is 100% clean, but this box shows none of the known signs.
What This Means for You
Your box is clean as delivered. From here, your safety depends mostly on what you install.
The HK1 X50 is an open, uncertified box built so you can install any app you like. That freedom comes with a trade-off: it has fewer of the built-in safety locks found on Google-certified devices, so a bad app can do more damage than it could on a locked-down device.
Popular apps from their official sources – TiviMate, SmartTube, Weyd, Stremio, Kodi and similar – carry little risk. The danger comes from unknown apps, repackaged copies of popular apps, and unofficial download links. The checklist below is for those.
Before You Sideload a Risky App
Spend five minutes on these checks before installing any app from a source you don’t fully trust. If an app fails any of them, don’t install it.
- Find the official source. Download only from the developer’s own website or GitHub page, or ask us and we’ll point you to the right one. Avoid APK mirror sites, links in comments or Telegram groups, and Downloader codes from strangers.
- Check its reputation. Search the app’s name plus “malware”, “virus” or “reddit”. Look for recent complaints and whether the app is still maintained. An app that vanished from its official site and now only lives on mirrors is a red flag.
- Scan the file first. Download the APK on a phone or computer and upload it to VirusTotal. One or two vague detections from minor engines are common; several engines naming a trojan, adware or backdoor means don’t install it.
- Make sure it’s the real app. Compare the name, icon and version with the developer’s page. Fakes often have slightly different names, odd file sizes, or promise “premium unlocked” versions.
- Watch what it asks for. Most apps need some permissions to work, such as storage access, display over other apps, and “Install unknown apps” so they can install their own updates. Be wary of a streaming app that asks for Accessibility access, device administrator rights, or access to your contacts, SMS, camera or microphone. If it does, cancel and uninstall it.
- Close the door afterward. Once installed, turn off “Install unknown apps” for the app you downloaded it with, such as Downloader or a browser.
- Protect your accounts. Never type your debrid, Google or streaming passwords into an app you’re unsure of. Use the provider’s official pairing or activation page instead.
Kodi tip: the same rules apply to add-ons and repositories. Stick to well-known repositories and remove any you no longer use.
Add a VPN for Privacy
A VPN encrypts your connection so your internet provider and others on your network can’t see what you’re streaming. It also helps protect your box on public or shared Wi-Fi.
EXCLUSIVE DEAL
Protect Your Privacy with IPVanish
Encrypt your connection on any network and keep your streaming private. Get our exclusive IPVanish discount.
Warning Signs & What to Do
Contact us if you notice any of these:
- Apps appear that you didn’t install, or settings change on their own.
- The box suddenly becomes slow or hot while sitting idle with nothing open, and a restart doesn’t help.
- Your router or internet provider shows heavy data use from the box when nobody is watching.
- An “Allow USB debugging?” message pops up. Always tap Cancel, never Allow.
- Your debrid or streaming accounts show logins or devices you don’t recognize.
Normal slowdown: some gradual slowdown is normal as a box ages or when many apps are left running in the background. Restart the box and close apps you aren’t using before assuming something is wrong.
If something seems wrong
- Uninstall the most recently added app (Settings → Apps).
- If the problem continues, unplug the box from the internet and contact us. We can check it, or reset and set it up again.
- Change the passwords of accounts used on the box, starting with your debrid service, and generate a new debrid API key if your service offers one.
- Optional: put the box on your router’s guest Wi-Fi, separate from your computers and phones.
Email us, chat on Telegram, or book an appointment.
Sources
- The Hacker News: Google disrupts 1.3 million-device Android botnet
- CNX Software: Google-certified Android TV boxes found to have malware
- McAfee: XCPE botnet – is your Android TV box hacked?