🔍 Read the full analysis: The TV Box Botnet Google Disrupted Was Linked To Factory Malware on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Google said on Nov. 2 that it disrupted the XCPE botnet, which used a backdoor built into some Android TV box firmware. TrendAI counted 1,472,554 infected devices from June 3 to Oct. 1, 2026, a figure it describes as a lower bound. Google accused manufacturer Videostrong of operating the backdoor for profit; the company has not publicly responded in the cited reports.
Google and industry partners disrupted XCPE, a botnet built from Android TV boxes infected through firmware, and accused device maker Videostrong Technology of developing and operating the backdoor for profit. Google said the botnet involved more than 1.3 million set-top boxes, while security partner TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, a total it calls a lower bound.
Google’s Threat Intelligence Group said on Nov. 2 that it worked with Japan’s National Police Agency and security companies to disrupt the botnet’s control infrastructure in late October. Google said the operation included legal action to take down domains and servers used to control XCPE and distribute malware. The company also said it acted against control servers associated with more than a dozen malware families that had been installed on affected boxes as add-ons.
According to Google, XCPE’s backdoor was built into device firmware before the boxes reached buyers. The software, identified in some versions as x.cpe or com.oemservice, had system-level privileges. Google said it could reinstall itself after a reboot if removed, communicate with remote control servers and allow operators to install applications or run commands. The company also reported capabilities including screenshots, keystroke injection, collection of account and device information, and remote shells.
Google said the infected boxes were used mainly as residential proxies, routing third-party internet traffic through owners’ home connections, and for advertising fraud. The company said it had high confidence Videostrong was responsible and had sold access to criminal partners. Google has barred Videostrong and future affiliates or subsidiaries from building certified Android devices or supplying software to certified vendors, and said it changed its firmware review process. The Record and heise reported that Videostrong did not respond to their requests for comment.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Why Infected TV Boxes Matter
The case shifts attention from users’ app-installation choices to the device supply chain. If malicious code is placed in firmware before a product is sold, ordinary precautions such as avoiding suspicious links may not prevent infection. Google said some affected boxes were Google-certified, making the reported method relevant beyond buyers who knowingly choose unofficial or modified devices.
Compromised boxes can also make harmful activity appear to originate from ordinary residential internet connections. Google said XCPE operators and their affiliates used devices for proxy services and ad fraud, and reported other remote-control capabilities. That creates risks for device owners and for organizations whose systems may receive traffic from an infected home or office network. The scope of those wider effects has not been independently quantified in the source material.
The disruption may limit operators’ ability to control devices, but Google said the backdoor remains in firmware and can return after a reboot. That means taking down servers is not the same as cleaning every affected box. Owners may need to treat a suspected device as untrusted rather than assume that removing an app or restarting it has resolved the problem.
Popular right now
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
Shark HydroVac MessMaster Wet/Dry Vacuum & Mop Combo (AW261)
Bose QuietComfort Wireless Noise Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
How XCPE Reached the Devices
Google described Videostrong as an Android original equipment and original design manufacturer, meaning it makes devices for its own brand and for other companies’ brands. Its report, titled Shutting the Door on the XCPE Botnet, said the backdoor and botnet were intentionally developed, deployed and operated for financial gain. That is Google’s attribution; Videostrong’s response was not included in the cited reporting.
Google said the backdoor used a small system app embedded in the firmware and connected to control servers after startup. The company reported that the software disabled Google Play Protect checks before installing other apps. Since at least late 2024, Google said, the system had separate components for communicating with servers, loading software and running revenue-generating modules. In August 2026, Google observed new droppers disguised as Android system apps replacing the loader.
The scale figures describe different things. Google gave a rounded total of more than 1.3 million set-top boxes. TrendAI recorded 1,472,554 infected devices during the specific period from June 3 through Oct. 1 and called that number a lower bound. Google also estimated that taking down servers for add-on malware could cut access to at least 10 million additional compromised devices. That is an estimate, not a device count from the XCPE tally, and the source material says those additional devices did not all run Android.
“The backdoor and the botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Did Not Resolve
The cited material does not identify the court, case number or public filing behind Google’s legal actions. It also does not establish how many boxes remain infected, which specific retail models or brands were affected, or how many owners have been notified. Google said the firmware backdoor persists after the control-server disruption and can reinstall after a reboot, but the source material does not describe a universal remote cleanup method.
Videostrong’s account of the allegations is not available in the cited reporting. The exact number of devices used for each activity, the amount of advertising fraud or proxy traffic, and the extent of any resulting harm to users are also unclear. Google’s estimate of at least 10 million additional devices concerns other malware families and should not be read as a count of XCPE boxes.
Checks for Owners and Vendors
Google said it has tightened checks on firmware integrity for certified Android TV devices and barred Videostrong from participating in its certified-device program. The effectiveness and reach of those changes will depend on how they are applied to devices and software supplied through manufacturers and vendors. The source material does not give a timeline for further enforcement or public release of court records.
Owners can check whether a box is Play Protect certified and be cautious about no-name or “unlocked” products, though certification alone does not guarantee that a device is unaffected. For a box suspected of compromise, the source recommends unplugging or replacing it rather than relying on an app uninstall or reboot. Keeping streaming devices on a separate guest network can limit their access to other devices. Businesses should account for home and office connected devices in security planning and avoid treating an IP address’s residential reputation as proof that its traffic is safe.
Key Questions
What was the XCPE botnet?
XCPE was a botnet made up of Android TV boxes with a firmware backdoor, according to Google. The compromised devices could be remotely controlled and used for activities including residential proxy services and ad fraud.
How many devices were affected?
Google said the botnet involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to Oct. 1, 2026, and described that number as a lower bound. The figures are not a count of all devices still infected after the disruption.
Who did Google say was behind the backdoor?
Google attributed the backdoor to Videostrong Technology, saying with high confidence the manufacturer developed and operated it for financial gain. Videostrong did not respond to requests for comment cited by The Record and heise.
Does the takedown remove the malware from a TV box?
Not necessarily. Google said the disruption cut off control infrastructure, but the backdoor remains in firmware and can reinstall after a reboot. The source material does not describe a single cleanup procedure that works for every affected device.
What should owners do if they suspect their box is infected?
The source recommends treating a suspicious box as untrusted: unplug it or replace it, check its Play Protect certification and keep streaming devices on a separate guest network. An app uninstall or reboot may not remove firmware-level malware.
Source: ThorstenMeyerAI.com
