🔍 Read the full analysis: What Made This TV Box Botnet A Google Takedown Target? on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google said on Nov. 2 that it and industry partners, working with Japan’s National Police Agency, disrupted the XCPE botnet’s control infrastructure. Google attributes the operation to TV-box manufacturer Videostrong and says more than 1.3 million set-top boxes were involved; the backdoor may persist in device firmware even after the servers are disabled.
Google said on Nov. 2 that it had worked with industry partners and Japan’s National Police Agency to disrupt the control infrastructure of XCPE, a botnet linked to more than 1.3 million Android set-top boxes. Google says the backdoor was built into firmware by device maker Videostrong Technology, allowing infected boxes to be used for proxy traffic, ad fraud and other remote operations.
Google’s Threat Intelligence Group (GTIG) said it took legal action to disable domains and servers used to control XCPE and distribute malware. The company also said it pursued action against control servers for more than a dozen malware families installed as add-ons. Google worked with Lumen, HUMAN Security, Plume, Synthient and TrendAI, as well as Japan’s National Police Agency.
Google’s estimate was more than 1.3 million set-top boxes. Separately, partner TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, describing its figure as a lower bound. The figures refer to identified infected devices during the stated period; the source material does not establish that every device remained active at the same time.
According to GTIG, most of the observed activity involved using devices as residential proxies—routing outside users’ internet traffic through a box owner’s connection—and running ad fraud. Google also reported that operators could install apps, execute commands, capture live screenshots, simulate keystrokes, collect account and device data, scan local networks and open remote shells. These capabilities describe what Google said it observed; the source material does not quantify how often each was used.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
A Factory Backdoor Changes the Risk
The case matters because Google says the compromise was embedded in device firmware before sale, rather than relying only on an owner clicking a malicious link or installing a fake app. If that account is accurate, ordinary app removal or careful browsing would not address the initial source of the infection. The affected hardware could appear to work normally while its internet connection was used by others.
Google said some infected boxes were Google-certified. It accused Videostrong of using obfuscation to get malicious code past checks, then loading it after a device’s first boot. Google has barred the company and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and says it has tightened firmware-integrity reviews. The report does not identify every affected model or seller, limiting consumers’ ability to check a box by brand alone.
Google also said disabling control servers for the add-on malware could cut off access to at least 10 million additional compromised devices. That is the company’s estimate of a wider effect, not a device-by-device count; the source report says those devices entered through other channels and not all were Android devices. For households and businesses, the case is a reminder that low-cost connected equipment can create security risks beyond the device itself, including misuse of a home or office internet address.
Products Worth Considering
Samsung 27-inch Odyssey G5 QHD Gaming Monitor (G51F)
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER), QHD
Samsung Odyssey G4 25-inch FHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
GTIG’s report, titled “Shutting the Door on the XCPE Botnet,” says the backdoor was a small system app identified in some builds as x.cpe and in others as com.oemservice. Google says it had system-level privileges and could restore itself from a protected partition after a reboot if removed. The botnet’s control system could then provide instructions and deliver additional software.
Google says the operation had developed into a layered system by at least late 2024, separating the communication component, a loader and money-making modules supplied by affiliates. The report describes residential proxy use and ad fraud as the main monetization activity. Google also says new droppers disguised as Android system apps appeared in August 2026, which it interpreted as an effort to maintain concealment.
Google attributes the backdoor’s development and operation to Shenzhen-based Videostrong Technology Co., an Android device manufacturer that builds products for its own brand and for other companies. The company did not respond to comment requests from The Record and heise, according to the source material. Google’s allegations have not been accompanied there by a publicly available court filing or case record.
“The backdoor and the botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Has Not Removed
The server disruption does not necessarily remove the malicious software from devices already infected. Google’s report, as summarized in the source material, says the backdoor remains in firmware and can reinstall after a reboot; uninstalling the app alone may not remove it. It is unclear how many affected boxes remain connected, which specific models and retail listings are involved, or whether every device associated with the botnet has been identified.
The allegations against Videostrong also remain distinct from a court finding. The supplied material says Google did not publish the court filing and no public case record was located, while Videostrong had not responded to requests for comment from The Record and heise. The basis and measurement method behind Google’s estimate of at least 10 million additional devices are not fully detailed in the source material.
Device Checks and Security Changes
Google says it has banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and has changed its firmware review process. The source material does not give a timetable for the new checks or say whether affected users will receive device-specific alerts, firmware updates or replacement guidance.
For owners, the source advises checking whether an Android TV box is Play Protect certified and being cautious with no-name or “unlocked” devices. Because the reported backdoor can persist in firmware, a suspicious box should be treated as untrusted: unplugging or replacing it is safer than relying on an app uninstall. Keeping a TV box on a separate guest network can limit its access to other devices. Businesses should include connected equipment in their security planning and not rely on IP reputation alone, since proxy traffic can make malicious activity appear to come from a legitimate household or office connection.
Key Questions
What was the XCPE botnet?
XCPE was a network of compromised Android set-top boxes. Google says the boxes could be remotely controlled and used mainly for residential proxy traffic and ad fraud, with additional capabilities such as installing apps and capturing screenshots.
How many devices were affected?
Google said the botnet involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to Oct. 1, 2026, and called that a lower bound. These figures do not establish that all counted devices were active at the same time.
Did Google say Videostrong was responsible?
Yes. Google’s Threat Intelligence Group attributed the backdoor’s development and operation to Videostrong Technology Co. That is Google’s allegation; the supplied material says the company had not responded to comment requests and that no public court filing or case record was identified.
Does the takedown remove the backdoor from a TV box?
Not necessarily. Google says the action disabled control infrastructure, but the backdoor remains in firmware and can reinstall after a reboot. The source material says uninstalling the app alone does not remove it.
What should owners do if they have a suspicious box?
Check its Play Protect certification, be cautious with no-name or “unlocked” devices, and consider unplugging or replacing a box suspected of infection. Keeping connected TV equipment on a guest network can reduce its access to other devices, but the supplied material does not identify a universal consumer cleanup tool.
Source: ThorstenMeyerAI.com
