🔍 Read the full analysis: A 1.3-Million-Device TV Box Botnet Raises Questions About Factory Malware on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google said it and industry partners disrupted the XCPE botnet in late October, which involved more than 1.3 million Android set-top boxes. Google alleges manufacturer Videostrong built and operated the firmware backdoor for profit; infected boxes may remain compromised after the servers are cut off.
Google says it and industry partners disrupted the XCPE botnet in late October, cutting off control servers used to manage more than 1.3 million Android set-top boxes. Google alleges that Shenzhen-based manufacturer Videostrong Technology built and operated a backdoor embedded in device firmware, allowing infected boxes to be used for activities including residential proxy traffic and ad fraud.
Google’s Threat Intelligence Group (GTIG) published its account on November 2, saying it worked with Japan’s National Police Agency and security firms to take action against the botnet’s infrastructure. Partner TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and described that figure as a lower bound. Google’s own public description says the botnet involved more than 1.3 million boxes.
According to GTIG, a system app embedded in firmware contacted control servers and could receive instructions to install software or run commands. The infected devices were used mainly as residential proxies, routing third-party traffic through owners’ internet connections, and for ad fraud. Google also reported capabilities including taking screenshots, injecting keystrokes, collecting account and device data, and opening remote shells. Those capabilities do not establish that every infected box was used for every activity.
Google said its response included legal action to disable domains and servers used to control XCPE and distribute additional malware, a ban preventing Videostrong and future affiliates from making certified Android devices or supplying software to certified vendors, and changes to firmware-integrity checks. Google also said disabling servers associated with more than a dozen malware families could cut off access to at least 10 million additional compromised devices. That is Google’s estimate, not a verified device count, and the affected devices are not all necessarily Android products.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
A Firmware Backdoor Changes the Risk
The case differs from infections that begin when a user installs a malicious app or clicks a harmful link. Google says the XCPE backdoor was placed in device firmware before sale, giving it system-level access and making removal harder for owners. The company also said some affected boxes were Google-certified, raising questions about how firmware checks can miss code that activates after an initial review.
For households, a compromised streaming box can expose the home internet connection to traffic from outside the household, while its capabilities may extend to data collection and remote commands. For businesses, the incident is a reminder that consumer and office-connected devices can be used as part of an attack surface. A familiar or local-looking internet address is not, on its own, proof that traffic is trustworthy.
The server takedown disrupts the operators’ ability to control infected devices through the infrastructure that Google targeted. It does not, by itself, repair firmware already installed on a box. That distinction matters for owners deciding whether an affected device is safe to keep connected.
Products Worth Considering
Apple MacBook Pro 14.2-inch with M5 Max, 18-core CPU, 32-core GPU, 36GB Memory, 2TB SSD, Wi-Fi 7, Silver
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How XCPE Reached the Boxes
GTIG says the backdoor appeared in firmware on Android set-top boxes made by Videostrong, an original equipment and design manufacturer that produces devices for its own brand and other companies. The report identifies the system app as x.cpe on some versions and com.oemservice on others. Google says the app had system-level privileges and could restore itself from a protected partition after a reboot if removed.
According to Google, the software contacted a control server when a device started and maintained a connection for instructions. The company says the operators used obfuscation, including loading malicious code after the first boot, to evade checks on certified devices. GTIG traced the design back to at least late 2024 and said new droppers disguised as Android system apps appeared in August 2026.
Google attributes the operation to Videostrong with “high confidence,” saying the company developed and operated the backdoor for financial gain and sold access to criminal partners. Videostrong did not respond to requests for comment from The Record and heise, according to the source report. Google also said the malware’s add-on modules came from affiliates. These are allegations reported by Google, not findings presented here from a published court ruling.
“The backdoor and the botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Leaves Behind
The reported server disruption does not establish that every infected device has been identified or cleaned. Google says the backdoor remains in firmware and can reinstall after a reboot, so cutting off control servers is not the same as removing the infection. The source material does not describe a verified remote cleanup or a manufacturer-provided firmware fix for affected boxes.
The public account also leaves questions about the full device list, the number of owners whose data or internet connections were actually used, and the precise scale of each type of activity. Google says it took legal action but did not publish the court filing in the source report; no case number or court was identified there. Videostrong’s response to the allegations was not available, and the company did not answer requests for comment reported by The Record and heise.
Device Checks and Firmware Safeguards
Google says it has barred Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and has tightened checks of firmware integrity on certified Android TV devices. The source material does not provide a timetable for those changes or identify a public list of affected models.
Owners can check whether a box is Play Protect certified, but certification alone may not resolve the risk described in Google’s report. The source recommends treating suspicious or no-name devices as untrusted: disconnecting or replacing them and keeping TV boxes on a separate guest network. Businesses can review connected home and office devices as part of their security exposure rather than relying only on the apparent reputation of an IP address. Because the backdoor may survive a reboot, uninstalling an app should not be assumed to remove it.
Key Questions
What is the XCPE botnet?
XCPE is the name Google gave to a network of compromised Android set-top boxes. Google said it involved more than 1.3 million devices and that the boxes could be controlled through backdoor software in their firmware.
How were the TV boxes infected?
Google says the backdoor was embedded in firmware before the boxes reached owners. That differs from malware installed after a user clicks a link or downloads an app, and the report says the backdoor could restore itself after a reboot.
Did the takedown remove the malware from affected boxes?
Not according to the source report. The operation cut off control servers, but Google says the backdoor remains in device firmware. The material does not describe a confirmed cleanup method or a verified firmware fix for every affected model.
How can owners check whether a box is affected?
The source recommends checking the device’s Play Protect certification and being cautious with no-name or “unlocked” boxes. It does not provide a complete model list or say that certification checks alone can identify every infected device. Owners who suspect compromise can disconnect or replace the box and use a separate guest network.
Has Videostrong responded to Google’s allegations?
The source report says Videostrong did not respond to requests for comment from The Record and heise. Google’s claims about the company’s role should therefore be understood as allegations attributed to Google, not as a publicly cited court finding in the material provided.
Source: ThorstenMeyerAI.com
