🔍 Read the full analysis: Google’s Response To A 1.3-Million-Device TV Box Botnet on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google says it and industry partners disrupted the control infrastructure for XCPE, a botnet linked to more than 1.3 million Android TV boxes. Google attributes the firmware backdoor to device maker Videostrong, which it has barred from making certified Android devices; the backdoor may remain on affected boxes after the takedown.
Google says it and industry partners disrupted the control infrastructure of XCPE, a botnet linked to more than 1.3 million Android TV boxes, and barred the device maker it blames from producing certified Android devices. The company says the malware was embedded in device firmware before sale, meaning affected boxes could remain compromised even after the botnet’s remote control servers were taken down.
Google’s Threat Intelligence Group (GTIG) said on November 2 that it worked with Japan’s National Police Agency and security companies to take action against XCPE. Google described the botnet as intentionally developed and operated for financial gain by Videostrong Technology Co., an Android device manufacturer. Google said it acted against domains and servers used to control the botnet and distribute malware, and against control servers for more than a dozen malware families installed as add-ons.
The device count varies by source and measurement period. Google reported more than 1.3 million set-top boxes; partner TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and characterized that figure as a lower bound. Google also estimated that taking down servers for associated malware families would cut off access to at least 10 million additional compromised devices. That is an estimate, not a confirmed count, and the source report says those devices do not all run Android.
According to Google, the boxes were used mainly as residential proxies, routing third-party traffic through owners’ internet connections, and for ad fraud. GTIG also reported operators could capture screenshots, simulate keystrokes, gather account and device information, and open remote shells. Google said some affected devices had been certified for Android, and that malicious code was loaded after the first boot to evade checks. It has banned Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and said it tightened firmware-integrity reviews.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
The Risk Persists on Infected Boxes
The operation disrupts the infrastructure operators used to communicate with infected boxes, but it does not necessarily remove malware already stored on them. Google’s account says the backdoor resides in firmware and can reinstall itself from a protected partition after a reboot. If that description applies to a device, deleting an app or restarting the box is not a reliable cleanup method.
For owners, the concern is not limited to streaming or device performance. A residential proxy can make outside traffic appear to originate from a household or office connection, potentially bringing unwanted activity onto that network’s address. The reported ability to access data or issue commands adds a separate privacy and security risk. For organizations, the case also shows why connected devices on home and office networks can matter to security teams, even when they are not conventional computers.
Products Worth Considering
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Samsung Odyssey G4 25-inch FHD Gaming Monitor
Amazon Kindle Scribe (64GB) with Premium Pen, Metallic Jade
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Firmware
GTIG described a system app named x.cpe, also found as com.oemservice in some builds, as part of the backdoor. Google says it had system-level privileges and could restore itself from a protected partition if removed. The device contacted a control server at startup, received settings and maintained a connection that could be used to install additional software or issue commands.
Google says the malware disabled Google Play Protect checks before installing other apps. It described a layered design, with a small component communicating with the server, a separate loader and additional modules supplied by affiliates. The reported use of firmware and delayed loading matters because a device may appear ordinary during initial checks yet behave differently after its first startup. Google said the XCPE operation had been active since at least late 2024.
Google’s report names the National Police Agency of Japan and security partners Lumen, HUMAN Security, Plume, Synthient and TrendAI. The source material says Videostrong did not respond to requests for comment from The Record and heise. Google’s attribution is its assessment; Videostrong’s account is not included in the cited material.
“The backdoor and the botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
The Remaining Firmware and Legal Questions
The supplied material does not identify the affected box models, brands or geographic distribution, or establish how many owners have an infected device. It also does not specify a public court, case number or filing for the legal actions Google described. Videostrong’s response was not available in the source material, so the company’s position on Google’s allegations remains unknown.
Google’s account says the botnet’s control infrastructure was disrupted, but does not establish that every infected box has lost all malicious functionality or that all related malware servers are offline. The source material also does not describe a firmware update or other remote remediation that removes the backdoor. The TrendAI count covers a defined observation period and is described as a lower bound; it should not be read as a final global total.
Steps for Owners and Google’s Follow-Up
Google’s next reported measures are changes to firmware-integrity checks for certified Android TV devices and enforcement of its ban on Videostrong and related entities. The material does not give a timeline for additional review results, a list of affected products or a process by which owners can confirm whether a specific device contains the backdoor.
Owners can check whether a device is Play Protect certified, but certification alone should not be treated as proof that a box is safe: Google said some infected devices were certified. The source recommends treating a suspicious or no-name box as untrusted, unplugging or replacing it, and keeping TV devices on a separate guest network. Businesses should account for connected devices on office and home networks and avoid relying only on an IP address’s reputation when judging traffic.
Key Questions
What did Google do about the XCPE botnet?
Google says it and partners disrupted the botnet’s control infrastructure in late October 2026. It also took action against servers tied to malware distributed to affected boxes and banned Videostrong from making certified Android devices or supplying software to certified vendors.
How many TV boxes were affected?
Google reported more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and called that a lower bound. The figures have different descriptions and should not be treated as a final total.
Does the takedown remove the malware from a TV box?
Not necessarily. Google says the backdoor was embedded in firmware and could reinstall itself after a reboot. The reported disruption targets control infrastructure; the source does not describe a fix that removes the backdoor from every affected device.
What were infected boxes used for?
Google says the main uses were residential proxy services and ad fraud. It also reported capabilities including screenshot capture, simulated keystrokes, data collection and remote command access.
Can Play Protect certification confirm a box is safe?
No. Google said some infected boxes had Android certification and alleged the malicious code was loaded after initial checks. Certification may be useful to check, but the supplied information does not present it as a guarantee that a device is uncompromised.
Source: ThorstenMeyerAI.com
