🔍 Read the full analysis: Factory Malware And The Rise Of A 1.3-Million-Device TV Box Botnet on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Google said on Nov. 2 that it had disrupted the XCPE botnet, which involved more than 1.3 million set-top boxes with a backdoor Google attributes to manufacturer Videostrong Technology. The boxes were used mainly as residential proxies and for ad fraud, while the backdoor can remain in firmware after the control servers are taken down. Google has barred Videostrong from certified Android work and says it changed firmware checks.
Google said on Nov. 2 that it had worked with industry partners and Japan’s National Police Agency to disrupt the XCPE botnet, which involved more than 1.3 million set-top boxes. Google attributes the firmware backdoor to Shenzhen-based manufacturer Videostrong Technology, saying the boxes were used for activities including residential proxy services and ad fraud.
Google’s Threat Intelligence Group said the operation cut off domains and servers used to control XCPE and deliver malware. Partner TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, and described that number as a lower bound. Google’s broader estimate refers to more than 1.3 million boxes; the figures reflect different reporting and counting, rather than a confirmed total of every affected device.
According to Google, the backdoor was embedded in device firmware and could communicate with remote control servers. The company says operators used the boxes mostly as residential proxies, routing third-party traffic through owners’ internet connections, and for ad fraud. Google also reported capabilities to capture live screenshots, inject keystrokes, collect account and device information, and open remote shells. Those capabilities do not establish that every infected box was used for every purpose.
Google said the firmware component could reinstall itself from a protected partition after a reboot, so removing an app would not reliably remove the backdoor. It also said some affected devices had been Google-certified, and that the manufacturer used obfuscation to load malicious code after the initial boot. Google says it has barred Videostrong and its future affiliates from building certified Android devices or supplying software to certified vendors, and has tightened firmware integrity checks.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
A Backdoor Before First Use
The report describes a supply-chain risk: if the backdoor was present in firmware before sale, owners could be affected without clicking a malicious link or installing a suspicious app. That makes the usual advice to remove an unfamiliar application insufficient for these devices, according to Google’s account.
Compromised residential devices can also affect people who are not the box’s owners. Proxy traffic may make outside activity appear to come from a household or business connection, while ad fraud can generate activity that users never initiated. For organizations, the case is a reminder that connected equipment on home and office networks can create security exposure even when it is not a computer or phone.
Google said the takedown of control servers for add-on malware could cut off access to at least 10 million additional compromised devices. That is Google’s estimate of the wider effect, not a direct count of devices taken offline; Google said the malware spread through other channels, and not all of the devices are necessarily Android-based.
Popular right now
TCL 65-Inch QM6K QLED Mini-LED 4K HDR Smart Google TV, 144Hz
TCL 65-Inch T7 Series 4K QLED Smart Google TV, 144Hz (65T7)
Sony BRAVIA XR8B 65-Inch 4K OLED Google TV (K-65XR8B)
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
Google’s report, titled Shutting the Door on the XCPE Botnet, says the infection chain included a small system application identified as x.cpe and, in some builds, com.oemservice. Because it had system-level privileges and was stored in firmware, Google says it could restore itself after a user removed the visible app and restarted the device.
Google said the component contacted a control server after startup and could receive instructions. The system reportedly included a loader and separate modules, some supplied by outside groups or affiliates. Google said the botnet’s design had used this layered structure since at least late 2024, and that new droppers disguised as Android system apps appeared in August 2026.
The investigation involved Google, Japan’s National Police Agency, and security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google said it took legal action against domains and servers linked to Videostrong and against control servers for more than a dozen malware families found as add-ons. The source material does not include court filings or a public case number.
“The backdoor and the botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What The Takedown Leaves Behind
The available source material does not identify the specific box models, brands, or number of affected owners by country. Google said some infected devices were certified, but did not provide a complete public list of models or retail products. Videostrong did not respond to requests for comment reported by The Record and heise, according to the source article.
It is also unclear how many infected boxes remain in use or whether each device can receive a clean firmware update. Google says the backdoor can persist after the control servers are disrupted and return after a reboot; the takedown therefore cuts remote control but does not, by itself, establish that the underlying firmware has been repaired. The public material provided does not include court documents or independently verify Google’s attribution.
Checking Devices And Firmware
Google says it has changed its review process for certified Android TV firmware and barred Videostrong from certified Android device work. The public information provided does not specify a timetable for additional enforcement steps, firmware updates, or a complete list of affected products.
Google’s suggested precautions include checking whether a device is Play Protect certified and treating unknown or suspicious TV boxes as untrusted. The source recommends unplugging or replacing a suspect device, rather than relying on uninstalling an app, and placing TV boxes on a separate guest network. Businesses should account for connected devices on home and office networks and not rely only on IP address reputation when evaluating traffic.
Key Questions
What is the XCPE botnet?
XCPE is the name Google uses for a network of compromised set-top boxes. Google said more than 1.3 million boxes were involved and that the devices could be controlled remotely through a firmware backdoor.
How many devices were counted?
Google described the botnet as involving more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, calling that a lower bound. The sources do not provide a single independently verified final total.
Does taking down the servers remove the backdoor?
No. Google said the disruption cut off control servers, but the backdoor remained in firmware and could reinstall after a reboot. The takedown alone does not confirm that an affected device has been cleaned.
What should owners of a suspicious TV box do?
The source recommends checking the box’s Play Protect certification, unplugging or replacing a suspicious device, and keeping TV boxes on a separate guest network. It warns that uninstalling an app may not remove a firmware-level backdoor.
Source: ThorstenMeyerAI.com
