🔍 Read the full analysis: Factory-Linked Malware Reached 1.3 Million Devices In A TV Box Botnet on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google and partners disrupted the XCPE botnet in late October, after Google said more than 1.3 million set-top boxes had been infected by a backdoor built into device firmware. Google attributes the operation to manufacturer Videostrong, but the backdoor can survive an app removal and reinstall after a reboot, so the server takedown does not itself clean affected devices.
Google and industry partners disrupted the XCPE botnet in late October, a network the company says involved more than 1.3 million set-top boxes infected by a backdoor built into device firmware. Google says Shenzhen-based manufacturer Videostrong Technology Co. developed and operated the malware for profit, turning affected boxes into residential proxies and tools for ad fraud.
Google’s Threat Intelligence Group (GTIG) described the operation in a report published November 2. It said the company worked with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI to disrupt the botnet’s control infrastructure. Google said legal action took down domains and servers used to control XCPE and distribute malware, as well as control servers tied to more than a dozen other malware families found on the devices.
The infection was not limited to software installed by a user. According to Google, a system app embedded in firmware provided a persistent route back into the device. In affected builds, the component was called x.cpe or com.oemservice. GTIG said it had system-level privileges and could reinstall itself from a protected partition after a reboot if removed. Google also reported that operators could install apps remotely, issue commands, capture screens and gather account or device data.
TrendAI reported counting 1,472,554 infected devices between June 3 and October 1, 2026, and described that figure as a lower bound. Google’s own public wording was “more than 1.3 million set-top boxes.” The figures refer to observations over different reporting descriptions; they should not be read as a final count of every device affected. Google also estimated that action against the control servers for additional malware families could cut off access to at least 10 million more compromised devices. That is an estimate, not a verified device count, and those devices do not all necessarily run Android.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
When the Manufacturer Controls the Backdoor
The case matters because the reported entry point was factory firmware, rather than a malicious link or an app that an owner knowingly installed. If Google’s account is accurate, buyers could receive a device already configured to reconnect to an operator-controlled server, while ordinary app removal would not address the underlying persistence mechanism.
Google said some affected devices were Google-certified Android TV boxes. The company said Videostrong used obfuscation and delayed loading of malicious code until after a device’s first boot to evade review. Google has barred Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and says it has tightened firmware integrity checks. The incident raises questions for consumers and businesses about how certification and supply-chain checks detect behavior that activates only after initial inspection.
The reported proxy activity also creates risks beyond the box itself. When traffic is routed through a household or office internet connection, activity by an unknown third party can appear to come from that connection. Google and TrendAI also described ad fraud and other remote capabilities. A compromised device on a local network may give operators a foothold to inspect or interact with other connected systems, although the source material does not establish that every infected box was used for every listed function.
Products Worth Considering
Logitech MX Keys S Wireless Keyboard, Graphite
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Logitech MX Keypad Programmable Macro Pad for Developers, Graphite
As an affiliate, we earn on qualifying purchases.
How XCPE Stayed on TV Boxes
GTIG said the backdoor had been present in the malware design since at least late 2024. Its account describes several layers: a small component that contacts the control server, a loader that can fetch additional code, and separate modules used to generate revenue. In August 2026, Google observed new droppers disguised as Android system apps replacing the loader, which it interpreted as an effort to maintain concealment.
Google said the boxes were used mainly as residential proxies and for ad fraud. A residential proxy routes a customer’s internet traffic through another person’s connection, making it appear to originate from that home or office. The report also described more intrusive capabilities, including keystroke injection, screenshots, data collection and remote shells. These are capabilities Google reported seeing; the available source material does not say that every device was subjected to each action.
Google’s response included a ban on Videostrong from the certified Android ecosystem and changes to its review process. The company said legal measures targeted the botnet’s infrastructure and servers associated with other malware. A takedown can interrupt operators’ ability to issue commands, but it is distinct from removing malicious code already stored on devices.
“The backdoor and the botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Disruption Did Not Remove
The control-server disruption does not establish that malware was removed from affected boxes. Google’s technical account says the backdoor can restore itself from a protected partition after a reboot, meaning an ordinary app uninstall may not clear it. The source material does not provide a complete list of affected models, brands or serial numbers, nor a confirmed method for consumers to disinfect every model.
Google’s accusations against Videostrong are not accompanied in the supplied material by a published court filing, case number or court. Videostrong did not respond to comment requests from The Record and heise, according to the source report. Its account of the company’s role should therefore remain attributed to Google. The total number of devices affected across all malware families also remains uncertain: Google’s estimate of at least 10 million additional compromised devices is not a count, and the devices may include non-Android products.
Checking Devices and Network Exposure
Google said it has barred Videostrong from its certified Android device program and changed firmware review procedures. The source material does not give a timetable for further legal proceedings, publish a list of affected products or describe a universal consumer cleanup tool. Owners should check whether a TV box is Play Protect certified, but certification alone should not be treated as proof that a device is safe or free of malware.
For a box suspected of infection, the source report advises treating it as untrusted: disconnect it from the network and consider replacing it rather than relying on an app uninstall. Keeping streaming devices on a separate guest network can limit their access to other home or office systems. Businesses should include TV boxes and other connected devices in their security inventory and avoid treating an IP address’s reputation as sufficient evidence of who is using it. These steps reduce exposure; they do not confirm whether a particular device was part of XCPE.
Key Questions
What was the XCPE botnet?
XCPE was a botnet of compromised set-top boxes that Google said communicated with operator-controlled servers. Google reported that infected devices were used mainly as residential proxies and for ad fraud, with additional remote-control capabilities.
How many devices were affected?
Google said XCPE involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and called its figure a lower bound. The full number affected is not confirmed.
Does uninstalling an app remove the backdoor?
Not necessarily. Google said the backdoor was embedded in firmware and could reinstall from a protected partition after a reboot. The supplied material does not describe a universal cleanup procedure, so an app uninstall should not be assumed to remove it.
What should owners of a suspicious TV box do?
The source report recommends disconnecting a suspicious device or replacing it, checking its Play Protect certification, and keeping streaming boxes on a separate guest network. These steps are precautions and cannot determine on their own whether a box was infected.
Source: ThorstenMeyerAI.com
