🔍 Read the full analysis: Did Factory-Installed Malware Power This 1.3-Million-Device TV Box Botnet? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google said it helped disrupt the XCPE botnet, which involved more than 1.3 million Android TV boxes, and accused manufacturer Videostrong Technology of building and operating the firmware backdoor for profit. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, a figure it described as a lower bound. The control servers were disrupted, but the backdoor may remain on affected devices and return after a reboot.
Google says it helped disrupt the XCPE botnet, a network involving more than 1.3 million Android set-top boxes, and alleges that Shenzhen-based manufacturer Videostrong Technology built and operated the firmware backdoor for profit. The case matters because Google says some affected boxes were certified Android devices, while the disruption of the botnet’s control servers does not necessarily remove the backdoor from devices already in homes and businesses.
Google’s Threat Intelligence Group (GTIG) published its report, “Shutting the Door on the XCPE Botnet,” on November 2. Google said it worked with Japan’s National Police Agency and security companies to disrupt the botnet’s control infrastructure in late October. TrendAI separately counted 1,472,554 infected devices between June 3 and October 1, 2026, and described its count as a lower bound. Google’s own public figure was more than 1.3 million set-top boxes.
According to GTIG, the boxes contained a system-level backdoor in their firmware, meaning it could be present before a buyer set up the device. Google says the backdoor connected the boxes to control servers and allowed operators to install additional software and issue commands. The devices were used mainly as residential proxies, routing outside traffic through owners’ internet connections, and for ad fraud. Google also reported capabilities including taking screenshots, recording keystrokes, collecting account and device information, and opening remote shells.
Google said the response included legal action to take down domains and servers used to control the botnet and distribute malware, action against control servers tied to more than a dozen malware families, a ban on Videostrong building certified Android devices or supplying software to certified vendors, and changes to firmware-integrity checks for certified Android TV devices. Google also estimated that taking down the additional malware-control servers could cut off access to at least 10 million more compromised devices. That is Google’s estimate, not a verified count of affected Android boxes; the source report says those devices may include systems that do not run Android.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Why the Firmware Backdoor Matters
The allegation changes the usual picture of how malware reaches a consumer device. Rather than relying only on a user clicking a malicious link or installing a deceptive app, Google says the backdoor was built into device firmware by the manufacturer. If accurate, that could put buyers at risk before they have a meaningful chance to inspect or secure the box. The report also says some affected devices were Google-certified, raising questions about how malicious code passed through certification checks.
The practical concern is not limited to the owners’ screens or streaming accounts. A residential proxy can make a person’s home internet connection appear to be the source of someone else’s traffic. Google’s reported capabilities, including remote commands and local-network scanning, also mean an infected box could be a foothold for activity beyond ad fraud. The report does not establish that every infected box was used for every capability, but it describes a platform that operators and affiliates could use for several kinds of activity.
For organizations, the incident is a reminder that connected devices on home or office networks can affect security even when they are not conventional computers or phones. Google’s report says the control-server disruption cuts off operator access through that infrastructure, but the persistent firmware component may remain. That distinction matters: a takedown can interrupt a botnet without restoring an affected device to a trustworthy state.
Products Worth Considering
Anker SOLIX C300 Portable Power Station, 288Wh
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black
Apple MacBook Air 15-inch with M5 chip, 16GB Memory, 512GB SSD, and Liquid Retina Display
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
GTIG says the backdoor appeared as a small system app, identified in some builds as x.cpe and in others as com.oemservice. It reportedly had system-level privileges and could restore itself from a protected partition after a reboot if removed. Google says the software contacted a control server when the box started, fetched settings, and maintained a connection for further instructions. The report describes the ability to disable Google Play Protect checks before installing additional apps.
Google says the system had developed into multiple layers since at least late 2024: a component that contacted the server, a separate loader, and additional modules supplied by affiliates. It also reported that new droppers disguised as Android system apps appeared in August 2026. Google says Videostrong used obfuscation to get malicious code past certification checks by loading it after the device’s first boot. These are findings and interpretations in Google’s report; the source material does not include an independent technical examination of every affected device.
Google identifies Videostrong as an Android original equipment and design manufacturer, a company that can build devices for its own brand or for other brands. The company did not respond to requests for comment from The Record and heise, according to the supplied source material. Google’s actions included a ban covering Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors.
“The backdoor and the botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Has Not Settled
The source material describes Google’s attribution of the operation to Videostrong as a high-confidence assessment, but it does not provide a public court filing, case number, or court. Videostrong’s response is also absent: the company reportedly did not answer requests for comment. The available information therefore does not establish whether the company has disputed Google’s account or whether legal proceedings have produced findings.
The number of affected devices is not a single confirmed lifetime total. Google reported more than 1.3 million boxes, while TrendAI counted 1,472,554 from June 3 through October 1 and called that a lower bound. The source does not explain the full counting method or establish how many devices remained active after the disruption. Google’s estimate of at least 10 million additional devices concerns other malware families and channels, and should not be read as a count of XCPE-infected TV boxes.
It is also unclear how many affected models and brands were involved, how many boxes remain in use, and whether each reported capability was exercised on each device. Google says the backdoor can persist and reinstall after reboot; the supplied material does not describe a consumer update that removes it. Disrupting the control servers may limit remote control, but it is not the same as proving that every infected box is clean.
Device Checks and Google’s Response
Google says it has banned Videostrong from the certified Android ecosystem and tightened firmware-integrity reviews for certified Android TV devices. The source material does not give a schedule for those review changes or describe a firmware update that would remove the backdoor from existing boxes. Further public findings from Google, its partners, or law enforcement could clarify the scope of the operation and what remedies are available to owners.
For consumers, the source recommends checking whether a box is Play Protect certified and being cautious with no-name or “unlocked” devices. If a box appears suspicious, unplugging or replacing it is safer than relying on uninstalling an app, because Google says the backdoor can return after a reboot. Keeping streaming devices on a separate guest network can limit their access to other equipment on the home network. Businesses should treat connected devices as part of their security exposure and avoid relying on an IP address’s reputation alone.
These steps are precautions, not confirmation that a particular device is infected. The reporting does not provide a complete list of affected models or a tool that can determine whether an individual box contains the backdoor. Owners and organizations will need to watch for further vendor guidance and updates from Google and the relevant security partners.
Key Questions
What happened to the XCPE botnet?
Google said it worked with Japan’s National Police Agency and security partners to disrupt the botnet’s control infrastructure in late October 2026. The network involved more than 1.3 million set-top boxes, according to Google.
Did Google prove that Videostrong installed the malware?
Google’s Threat Intelligence Group said with high confidence that Videostrong built and operated the backdoor for financial gain. The source material does not report a court finding, include a public case record, or include a response from the company.
Does taking down the control servers remove the backdoor?
Not necessarily. Google says the backdoor remains in firmware and can reinstall itself after a reboot if removed as an app. The server disruption may restrict remote control, but the source does not identify a fix that cleans every affected device.
How many devices were infected?
Google reported more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and described its figure as a lower bound. The source does not establish a complete lifetime total.
What should owners of Android TV boxes do?
Check Play Protect certification, be wary of no-name or “unlocked” boxes, and consider unplugging or replacing a device that appears suspicious. Keeping a streaming box on a separate guest network can reduce its access to other devices, but the source does not provide a definitive consumer test for infection.
Source: ThorstenMeyerAI.com
