TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Google said on Nov. 2 that it and industry partners disrupted the XCPE botnet, which involved more than 1.3 million set-top boxes. Google alleges Videostrong Technology built and operated the firmware backdoor for profit; the company did not respond to media requests. The takedown cut access to control servers, but Google says the backdoor remains in affected devices and can return after a reboot.
Google’s Threat Intelligence Group (GTIG) said it worked with the Japan National Police Agency and security firms to take down domains and servers used to control XCPE and distribute malware. Partner TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, describing that figure as a lower bound. Google’s public summary gives the broader count as more than 1.3 million.
According to GTIG, affected boxes chiefly served as residential proxies, sending other people’s internet traffic through owners’ connections, and as tools for ad fraud. Google also reported capabilities to capture live screenshots, inject keystrokes, collect account and device data, open remote shells and install software without users’ knowledge. These are Google’s findings; the report does not establish that every listed capability was used on every infected box.
Google said the backdoor was embedded in firmware and could reinstall after a reboot if removed as an app. The company also said some affected devices had been Google-certified, and that Videostrong used obfuscation to load malicious code after initial checks. Google has barred Videostrong and its future affiliates from producing certified Android devices or supplying software to certified vendors, and says it has tightened firmware integrity reviews.
Could TV Boxes Carry Malware? A Factory Backdoor Exposed
Google says the XCPE botnet used compromised set-top boxes for residential proxy traffic and advertising fraud. The server takedown disrupted control, but the backdoor may remain in device firmware.
How the backdoor worked
Google says the firmware gave the malware system privileges, helping it survive app removal.
A system app was stored in a protected partition on affected boxes.
On startup, it contacted operators’ servers and received instructions.
Boxes chiefly routed third-party traffic through owners’ connections and supported ad fraud.
What the takedown changed
Google and industry partners disrupted XCPE’s control infrastructure in late October 2026.
- Access to XCPE control servers
- Domains and servers used to distribute malware
- Operators’ remote control of the botnet
- The backdoor remains in affected firmware
- It may return after a reboot
- Deleting an app does not establish that a box is clean
What owners and businesses can do
Certification alone cannot confirm that a device was unaffected.
- Check whether a box is Play Protect certified, but do not treat certification as proof it is safe.
- Treat a suspicious box as untrusted: unplug or replace it.
- Keep TV boxes on a separate guest network.
- Businesses should review consumer devices connected to office networks.
The case shows how a compromised TV box can expose more than the streaming device itself. A box on a home or office network can make the owner’s connection appear to be the source of outside traffic, while its remote-control features may give operators access to information or other devices on the local network. Google says the affected firmware gave the backdoor system-level privileges.
Google also said the control-server disruption is expected to cut access to at least 10 million additional compromised devices linked to malware families distributed through other channels. That number is an estimate, not a confirmed device count, and those devices do not all necessarily run Android. The gap between the estimate and a verified count matters when judging the overall scale of the operation.
For organizations, the incident is a reminder that inexpensive connected devices can become part of their security exposure, including when employees bring them onto office networks. Google recommends treating suspicious boxes as untrusted; security teams may also need to account for traffic from consumer devices rather than relying on an IP address’s reputation alone.
Products Worth Considering
Apple MacBook Air 15-inch with M5 chip, 16GB Memory, 512GB SSD, and Liquid Retina Display
Apple Watch SE 3 GPS Smartwatch, 40mm
Anker SOLIX C300 Portable Power Station, 288Wh
As an affiliate, we earn on qualifying purchases.
How XCPE Reached Certified Devices
GTIG’s report, titled “Shutting the Door on the XCPE Botnet,” describes a small system app named x.cpe or, in some builds, com.oemservice. Google says it was placed in firmware with system privileges and stored in a protected partition, allowing it to return after an app-level removal. On startup, the app contacted a control server for settings and maintained a connection through which operators could send instructions.
Google says the backdoor disabled Google Play Protect checks before silently installing additional apps. Since at least late 2024, GTIG describes the system as having separate layers for server communication, loading code and running modules supplied by partners. In August 2026, Google observed new droppers disguised as Android system apps that replaced the loader, which it interpreted as an effort to evade detection.
The company says it acted with Lumen, HUMAN Security, Plume, Synthient and TrendAI, as well as Japan’s National Police Agency. Google described legal action against the domains and servers used to control the botnet and against servers associated with more than a dozen malware families installed as add-ons. The source material does not include a public court filing or case number.
““The backdoor and the botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
The Backdoor After the Takedown
The server disruption limits operators’ remote control, but it does not remove the backdoor from device firmware. Google says it can reinstall after a reboot, so the available source material does not establish that affected boxes are clean or safe to reconnect. It also does not identify every affected model or brand, or provide a complete list of devices owners can check.
Videostrong’s response to the allegations was not available: The Record and heise reported that the company did not respond to their requests for comment. The source material also cites no public court filing. The exact basis and scope of the legal actions, the final number of infected boxes, and the extent to which operators used each capability remain unclear.
Checking and Replacing Affected Boxes
Google says it has changed its firmware review process and barred Videostrong from the certified Android device program. Owners can check whether a box is Play Protect certified, but certification alone may not settle whether a particular device was affected, given Google’s report that some certified boxes were compromised.
For a suspicious no-name or “unlocked” box, the guidance in the source material is to unplug or replace it rather than rely on deleting an app, and to keep TV boxes on a separate guest network. Businesses should review connected consumer devices on their networks. Further clarity would depend on device identification guidance, public details about the legal actions and any response from Videostrong.
Key Questions
What was the XCPE botnet?
Google says XCPE was a botnet of more than 1.3 million set-top boxes with a firmware backdoor. The boxes were used mainly as residential proxies and for advertising fraud.
Who does Google say was behind the backdoor?
Google alleges that Videostrong Technology Co. built and operated it for profit. The source material says the company did not respond to requests for comment from The Record and heise.
Did the takedown remove malware from infected TV boxes?
No. Google says the late October action disrupted the control servers, while the backdoor remains in firmware and can reinstall after a reboot. Removing its app alone does not remove the firmware component.
How many devices were affected?
Google reported more than 1.3 million set-top boxes. TrendAI counted 1,472,554 devices from June 3 to Oct. 1, 2026, and called its count a lower bound.
What should owners do if they suspect their box is infected?
The source material advises checking Play Protect certification and treating a suspicious box as untrusted: unplug or replace it, and keep TV boxes on a separate guest network. Certification does not rule out infection, since Google says some certified devices were affected.
Source: Thorsten Meyer AI
