🔍 Read the full analysis: TV Boxes, Factory Malware, And Google’s 1.3-Million-Device Botnet Takedown on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Google and industry partners disrupted the XCPE botnet in late October, after identifying more than 1.3 million infected set-top boxes. Google says the backdoor was built into firmware by device maker Videostrong; the takedown interrupted control but did not remove the malware from affected boxes.
Google and industry partners disrupted XCPE, a botnet involving more than 1.3 million Android set-top boxes, after identifying a backdoor embedded in some devices’ factory firmware. In a November 2 report, Google’s Threat Intelligence Group (GTIG) said it had worked with Japan’s National Police Agency and security firms to take down control infrastructure, and alleged with high confidence that manufacturer Videostrong Technology Co. built and operated the backdoor for financial gain.
Google said the disruption took place in late October. The company pursued legal action to take down domains and servers used to control XCPE and distribute malware. It also targeted control servers associated with more than a dozen malware families found as add-ons on infected boxes. Google said the operation involved the National Police Agency of Japan and security partners Lumen, HUMAN Security, Plume, Synthient and TrendAI.
The scale figures refer to different measurements. Google described the botnet as involving more than 1.3 million set-top boxes. TrendAI separately counted 1,472,554 infected devices between June 3 and October 1, 2026, and said its count was a lower bound. Google also estimated that shutting down servers for the add-on malware could cut off access to at least 10 million additional compromised devices. That figure is an estimate, not a count of devices in XCPE, and the source material says not all those devices run Android.
According to GTIG, infected boxes were used mainly as residential proxies, routing other parties’ internet traffic through owners’ home connections, and for ad fraud. Google also reported capabilities to capture live screenshots, record keystrokes, collect account and device information, scan local networks and open remote shells. The source material does not establish how many devices were used for each activity or how many owners were affected by particular actions.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Why Infected TV Boxes Matter
A compromised TV box can put more than its own streaming functions at risk. When traffic is routed through a household’s internet connection, activity by an outside operator may appear to come from that home’s IP address. That can expose owners to service complaints or scrutiny for activity they did not initiate, while ad fraud and other criminal uses can operate in the background.
The reported factory-level backdoor also changes what users can do to remove the threat. Google says the component can reinstall itself after a reboot, so deleting an app is not a reliable fix. The disruption affects the operators’ ability to reach infected boxes through the identified control infrastructure, but it does not by itself clean the firmware. For consumers and businesses, the incident is a reminder that low-cost connected devices can create security risks even when users have not installed suspicious software.
Google’s estimate of at least 10 million additional devices points to a wider potential effect from the malware families’ control servers, but it should not be read as 10 million XCPE boxes. The estimate concerns access to other compromised devices and includes devices that may not run Android. That distinction matters when interpreting the scale of the operation.
Popular right now
TCL 65 Inch QM8L Series SQD-Mini LED QLED 4K Smart Google TV
Philips 2200 Series Fully Automatic Espresso Machine with Classic Milk Frother, 2 Coffee Varieties, Intuitive Touch Display, Ceramic Grinder
Dyson W1 PencilWash Wet and Dry Cleaner with Dok Cordless Wet Floor Cleaner
As an affiliate, we earn on qualifying purchases.
How the Firmware Backdoor Worked
GTIG says the backdoor appeared as a small system app, identified in some builds as x.cpe or com.oemservice, with system-level privileges. The report says it contacted a control server when the box started and could receive settings or instructions. If a user removed the app, Google says it could be restored from a protected partition after the next reboot.
Google said the backdoor’s design included separate parts for communicating with its server, loading additional code and running modules supplied by affiliates. The company reported that the boxes could disable Google Play Protect checks before installing software. It also said some infected devices had been Google-certified, and alleged that Videostrong used obfuscation and delayed loading of malicious code until after initial startup to evade review.
Google said it has banned Videostrong, including future subsidiaries or affiliates, from building certified Android devices or supplying software to certified vendors. It also said it had tightened checks on firmware integrity for certified Android TV devices. The source material identifies Videostrong as a Shenzhen-based Android original equipment and design manufacturer, meaning it builds products for its own and other brands.
“The backdoor and the botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Did Not Remove
The disruption’s practical effect on individual boxes is not fully clear from the supplied reports. Google says the action took down control infrastructure, but the backdoor remains in firmware and can reinstall after a reboot. The source does not say whether every affected control server is now inaccessible, how many boxes remain infected, or whether operators have established replacement infrastructure.
Google’s allegation against Videostrong is presented as a high-confidence assessment by the company. The source material says Videostrong did not respond to requests for comment from The Record and heise. It also says Google did not publish the court filing and provides no public case record, court or case number. The allegations therefore should not be described as findings from a publicly available court ruling.
It is also unclear which specific brands and models contain the backdoor, how many certified devices were affected, and how many owners’ information or local networks were accessed. Google’s estimate of at least 10 million additional compromised devices is separate from its XCPE count, and the available material does not provide a device-by-device breakdown or a method that readers can use to determine exposure from the figure alone.
Next Steps for Owners and Google
Google says it has changed firmware review procedures for certified Android TV devices and barred Videostrong from the certification ecosystem. The supplied material does not give a timetable for further technical measures, a public list of affected models or a date for any additional law-enforcement announcements.
Owners can check whether a box is Play Protect certified, but certification alone should not be treated as proof that a device is safe. The source recommends treating suspicious or no-name boxes as untrusted: unplugging or replacing them, and keeping TV boxes on a separate guest network where possible. Because an app uninstall may not remove a firmware backdoor, users should not rely on deleting an unfamiliar app as a cure.
Organizations should account for connected devices in homes and offices as part of their security exposure, and avoid relying on IP reputation alone when evaluating network activity. The next public developments to watch are any further details from Google or law enforcement about affected products, remaining control infrastructure and remediation for devices whose firmware still contains the backdoor.
Key Questions
What did Google disrupt?
Google and partners disrupted control infrastructure for XCPE, a botnet involving more than 1.3 million set-top boxes, according to Google’s November 2 report.
How did the TV boxes become infected?
Google says a backdoor was built into the factory firmware of some Android TV boxes, rather than arriving only through an app installed by the owner. Google alleges manufacturer Videostrong developed and operated it.
Does the takedown remove the malware from a box?
Not necessarily. The source says the takedown cut off control infrastructure, while the backdoor remains in firmware and may reinstall after a reboot. Removing an app alone may not remove it.
How many devices were counted?
Google said XCPE involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 through October 1, 2026, describing its figure as a lower bound. Google’s estimate of at least 10 million additional compromised devices concerns other malware and is not an XCPE device count.
What should owners do if they are concerned?
Check the box’s Play Protect certification, be cautious with unbranded or “unlocked” devices, and consider unplugging or replacing a suspicious box. Keeping connected TV devices on a separate guest network can limit their access to other devices at home.
Source: ThorstenMeyerAI.com
