🔍 Read the full analysis: How A TV Box Botnet Grew To 1.3 Million Devices Before Google’s Takedown on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google and security partners disrupted the control infrastructure for XCPE, a botnet that Google says involved more than 1.3 million Android TV set-top boxes. Google attributes the firmware backdoor to manufacturer Videostrong, but says the takedown does not remove it from already infected devices. The company has barred Videostrong from certified Android devices and says it changed its firmware review process.
Google said it and industry partners disrupted the control infrastructure for XCPE in late October, cutting off a botnet that the company says involved more than 1.3 million set-top boxes. Google alleges that Shenzhen-based device maker Videostrong Technology built and operated a firmware backdoor for financial gain; the malware could turn affected boxes into residential proxies and tools for ad fraud.
In a report published November 2, Google’s Threat Intelligence Group said the backdoor was built into the firmware of some Android TV devices, rather than arriving through an app installed by an owner. Google said it worked with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI to disrupt the botnet’s servers and domains. The report attributes the operation to Videostrong with what Google described as high confidence. Videostrong did not respond to comment requests from The Record and heise, according to the source material.
Google said the compromised boxes were used mainly as residential proxies, routing third-party traffic through owners’ internet connections, and for ad fraud. The company also reported capabilities including taking screenshots, injecting keystrokes, collecting account and device information, and opening remote shells. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and described its figure as a lower bound. That count has a stated period and comes from a partner; it is distinct from Google’s broader phrasing of more than 1.3 million boxes.
Google said its response included legal action targeting Videostrong’s botnet infrastructure and control servers used by more than a dozen malware families, a ban on Videostrong and future affiliates from making certified Android devices or supplying software to certified vendors, and tighter firmware-integrity checks for certified Android TV products. Google also estimated that disabling the add-on malware servers could cut off access to at least 10 million additional compromised devices. That is an estimate, not a confirmed device count, and the source material says not all of those devices run Android.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
The Backdoor May Survive the Takedown
The operation highlights a security risk that is different from a user downloading a malicious app: malware placed in a device’s factory firmware can be difficult for owners to detect or remove. Google said the backdoor could reinstall itself after a reboot from a protected partition, so deleting an associated app would not necessarily clean an infected box. The server disruption limits the operators’ ability to control devices through the infrastructure taken offline, but does not itself erase the software already on them.
Google also said some affected devices were Google-certified. According to its report, Videostrong used obfuscation and loaded malicious code after the first boot to evade checks. That disclosure puts attention on device supply chains and certification reviews, as well as on the risks to consumers whose home connections can be used without their knowledge. For businesses, compromised home or office devices may also be relevant to network security; the source material advises against relying on IP reputation alone.
Products Worth Considering
Garmin Forerunner 165 GPS Running Smartwatch, 43 mm, Black
Oura Ring 4 Smart Ring – Silver – Size 8
Withings BPM Connect Wi-Fi and Bluetooth Blood Pressure Monitor
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
Google described a system app called x.cpe, or com.oemservice in some builds, embedded in device firmware with system-level privileges. The report says the component contacted a control server when a box started, fetched instructions and maintained a connection. It could then enable the installation of other software and remote commands. Google said the backdoor disabled Google Play Protect checks before installing additional apps.
Google said the design had used three layers since at least late 2024: a component that communicated with the server, a separate loader and modules supplied by affiliates. In August 2026, the company observed new droppers disguised as Android system apps replacing the loader, which it interpreted as an effort to stay hidden. The modules included proxy and ad-fraud tools. Google’s account describes the botnet as an operation involving both the firmware backdoor and add-on malware supplied by other parties.
Google’s takedown addressed the servers and domains used to control the botnet and distribute malware. It also described legal action against control servers for other malware families found as add-ons. The source material says Google did not publish the court filing, and no public case record or case number was identified there.
““intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Server Disruption Leaves Open
The available account does not establish how many infected boxes remain in use after the control servers were disrupted, or how many owners have received a firmware update that removes the backdoor. Google’s report says the malicious component can persist and reinstall after a reboot, but the source material does not describe a general cleanup method or a comprehensive list of affected models and brands.
Google’s attribution to Videostrong is a company assessment, not an independently adjudicated finding in the material provided. Videostrong’s response was not available to the outlets cited in the source material. The specific court filings and case details were also not available there. The figure of at least 10 million additional devices is an estimate tied to other malware families and should not be read as a confirmed count of Android TV boxes.
Device Checks and Security Changes
Google says it has tightened firmware-integrity checks for certified Android TV devices and barred Videostrong from building certified Android products or supplying software to certified vendors. The source material does not give a date for further enforcement steps or say whether every affected device maker will issue firmware updates.
Owners can check whether a box is Play Protect certified, but certification alone cannot settle whether a particular device is infected. The source material recommends treating a suspicious or untrusted box as unsafe: unplug or replace it, and keep TV devices on a separate guest network. Buyers can be cautious about no-name or “unlocked” boxes. Businesses should account for connected devices on home and office networks in their security practices. Whether those steps will reach all affected owners remains unknown.
Key Questions
What happened to the XCPE botnet?
Google and industry partners disrupted its control infrastructure in late October 2026. Google said the botnet involved more than 1.3 million set-top boxes.
Who does Google say was behind the backdoor?
Google’s Threat Intelligence Group attributed the backdoor and botnet to Videostrong Technology Co., saying it had high confidence in the attribution. The source material reports that Videostrong did not respond to comment requests from The Record and heise.
Does the takedown remove malware from an infected box?
No. The disruption targets the servers used to control the botnet. Google says the backdoor remains in firmware and can reinstall after a reboot, so uninstalling an app may not remove it.
How can owners check or protect a TV box?
Check Play Protect certification, be cautious with no-name or “unlocked” devices, and consider unplugging or replacing a box that seems untrustworthy. The source material also recommends placing TV boxes on a separate guest network. Certification is not proof that a device is free of infection.
How many devices were affected?
Google said more than 1.3 million set-top boxes were involved. TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and called that a lower bound. Google separately estimated that disabling servers for add-on malware could cut off access to at least 10 million additional compromised devices; that estimate covers a broader set of devices and is not a confirmed XCPE count.
Source: ThorstenMeyerAI.com
