🔍 Read the full analysis: The Malware Came From The Factory: Google Takes Down A 1.3-Million-Device TV Box Botnet on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google and industry partners disrupted the control infrastructure for XCPE, a botnet linked to more than 1.3 million set-top boxes, the company said on Nov. 2. Google alleges that device maker Videostrong built and operated the firmware backdoor for profit; the company did not respond to requests for comment cited by other outlets. The takedown cuts off remote control, but Google says the backdoor can survive a reboot, so affected devices may still need to be replaced.
Google said on Nov. 2 that it and industry partners had disrupted the control infrastructure of XCPE, a botnet linked to more than 1.3 million set-top boxes. Google alleges that Shenzhen-based device maker Videostrong Technology Co. built and operated a backdoor in the boxes’ firmware for financial gain, allowing operators to use them for residential proxy services, ad fraud and other remote activity.
Google’s Threat Intelligence Group said the operation involved legal action to take down domains and servers Videostrong allegedly used to control XCPE and distribute malware. Google also said it targeted control servers for more than a dozen malware families that had been installed on the boxes as add-ons. The company worked with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI.
The botnet estimate has more than one measure. Google described the affected population as more than 1.3 million set-top boxes. TrendAI separately reported counting 1,472,554 infected devices from June 3 to Oct. 1, 2026, and characterized its figure as a lower bound. Google also estimated that shutting down add-on malware control servers could cut access to at least 10 million additional compromised devices. That is an estimate, not a device count; the source material says not all those devices run Android.
According to Google, a small system app, identified in some builds as x.cpe or com.oemservice, was embedded in firmware with system-level permissions. The company says it could contact a control server, receive commands and install additional software. Google also reported capabilities including traffic routing through residential connections, ad fraud, screen capture, keystroke injection, collection of account and device data, and remote shell access. These are findings and allegations reported by Google, not independently established here.
Google said the backdoor could restore itself after a reboot from a protected partition, meaning deleting an app would not remove it. The company also said some affected devices were Google-certified and that Videostrong used obfuscation to load malicious code after initial setup, evading parts of the review process. Google said it has barred Videostrong and future affiliates from building certified Android devices or supplying software to certified vendors, and has changed its firmware review process.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
A Compromised Box Can Expose a Home Network
The case changes the usual security assumption that malware arrives because an owner clicked a bad link or installed a malicious app. Google’s account is that the backdoor was present in factory firmware, leaving buyers with little chance to spot it through ordinary caution. A TV box may appear to work normally while its internet connection is used to make other people’s traffic look as if it came from the household.
Residential proxy traffic can make it harder for websites and security teams to distinguish criminal activity from ordinary household use. The reported remote-access capabilities also raise concerns beyond the box itself: Google says operators could scan a local network and collect data. That does not establish that every infected device was used for every listed purpose, but it shows why low-cost connected devices can matter to both consumers and organizations.
The incident also raises questions about certification. Google says some infected models had passed its Android certification process, and that the malicious code was loaded after first boot. Its ban and revised checks address the company’s own certification ecosystem, but they do not remove firmware already installed on devices. Owners and network administrators therefore may need to take separate steps to limit exposure.
Popular right now
Sony BRAVIA XR8B 65-Inch 4K OLED Google TV (K-65XR8B)
Hisense 65-inch U6 Pro Mini-LED 4K UHD Smart Fire TV
TCL 65-Inch QM6K QLED Mini-LED 4K HDR Smart Google TV, 144Hz
As an affiliate, we earn on qualifying purchases.
How XCPE Reached Set-Top Boxes
Google’s report, titled “Shutting the Door on the XCPE Botnet,” says the backdoor and botnet were intentionally developed, deployed and operated for financial gain by Videostrong, an Android original equipment and design manufacturer that builds devices for its own brands and for other companies. Google says the system had operated since at least late 2024, with a structure separating the component that contacted the control server, a loader and additional money-making modules supplied by affiliates.
Those modules most often made boxes act as residential proxies, routing third-party traffic through a home internet connection, or as tools for ad fraud. Google says newer droppers disguised as Android system apps appeared in August 2026. The source material also reports that the malware could disable Google Play Protect app checks before installing other software.
Google’s response included disrupting Videostrong-linked control infrastructure, taking action against servers used by other malware families, banning the company from its certified-device program and tightening firmware integrity checks. The takedown was carried out with law-enforcement and industry partners, including Japan’s National Police Agency. The source material says Google did not publish a court filing, and provides no public case number or court details.
“The backdoor and the botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group, in its report “Shutting the Door on the XCPE Botnet”
What the Takedown Does Not Resolve
The source material does not identify the specific box models or brands affected, or provide a reliable way for buyers to determine whether a particular device contains the backdoor. Google’s statements about Videostrong and the malware’s capabilities are not accompanied here by a public court filing or case record. Videostrong did not respond to comment requests cited by The Record and heise, according to the source material.
It is also unclear how many infected boxes remain in use after the control servers were disrupted. The takedown interrupts remote control, but does not erase the firmware implant, according to Google. The separate estimate of at least 10 million additional devices concerns malware spread through other channels and should not be read as a confirmed count of XCPE-infected TV boxes.
Owners May Need to Replace Devices
Google says its updated review process will add checks on firmware integrity for certified Android TV devices, while its ban prevents Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors. The source material does not give a timeline for those changes or say whether Google will publish a list of affected models.
For consumers, the recommended precautions in the source material are to check a device’s Play Protect certification, be cautious about no-name or “unlocked” boxes, and treat a suspicious unit as untrusted. Because uninstalling an app may not remove firmware malware, disconnecting the box or replacing it may be safer than relying on an app removal. Keeping TV boxes on a separate guest network can limit their access to other devices. Businesses are advised to include home and office connected devices in their security planning and not rely on IP reputation alone.
Key Questions
What did Google take down?
Google said it and partners disrupted the XCPE botnet’s control infrastructure in late October, including domains and servers used to manage the operation and distribute malware.
How many TV boxes were involved?
Google said XCPE involved more than 1.3 million set-top boxes. TrendAI reported 1,472,554 infected devices counted between June 3 and Oct. 1, 2026, and called its count a lower bound.
Did Google say Videostrong was responsible?
Yes. Google said with high confidence that Videostrong built and operated the backdoor for profit. This is Google’s allegation and finding; the source material says Videostrong did not respond to comment requests cited by The Record and heise.
Does deleting the suspicious app remove the malware?
Google says no. The backdoor can reinstall itself from a protected firmware partition after a reboot, so removing an app may not remove the underlying implant.
What should owners of a suspicious box do?
The source material advises treating a suspicious device as untrusted: disconnect or replace it, check Play Protect certification, and place TV boxes on a separate guest network. It does not provide a definitive model list or a detection tool for individual owners.
Source: ThorstenMeyerAI.com
