🔍 Read the full analysis: A 1.3-Million-Device Botnet Put TV Box Malware On Google’s Radar on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google said on Nov. 2 that it and industry partners disrupted the control infrastructure for XCPE, a botnet involving more than 1.3 million set-top boxes. Google attributes the firmware backdoor to device maker Videostrong; the takedown cuts off remote control, but does not remove the backdoor from affected devices.
Google said on Nov. 2 that it had worked with industry partners and Japan’s National Police Agency to disrupt the control infrastructure of XCPE, a botnet involving more than 1.3 million set-top boxes. Google says Shenzhen-based manufacturer Videostrong Technology deliberately built and operated a firmware backdoor that let operators use affected devices for residential proxy traffic, ad fraud and other remote actions.
Google’s Threat Intelligence Group (GTIG) said the operation took place in late October and targeted domains and servers used to control the botnet and distribute malware. Google also said it pursued legal action against control servers for more than a dozen malware families found as add-ons on the boxes. The company worked with Lumen, HUMAN Security, Plume, Synthient and TrendAI, as well as Japan’s National Police Agency.
Google reported more than 1.3 million set-top boxes in the botnet. TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, describing that figure as a lower bound. The figures refer to devices observed during the stated period; they do not establish how many remain infected or online after the disruption.
According to GTIG, an embedded system app called x.cpe, or com.oemservice in some builds, gave the backdoor system-level access. It could reinstall itself from a protected partition after a reboot. Google says operators used infected devices mainly as residential proxies and for ad fraud, but also observed capabilities to capture screenshots, inject keystrokes, collect account and device information, scan local networks and open remote shells.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
The Risk Behind Certified TV Boxes
The case shows that a consumer device can be compromised before it reaches its owner, rather than through a later malicious download or a user clicking a harmful link. Google says some affected boxes were Google-certified Android devices, and that Videostrong used obfuscation to load malicious code after the initial boot in a way that evaded testing. That finding raises questions about how firmware is checked and how certification processes can detect code that activates later.
Residential proxy activity can make a customer’s internet connection appear to be the source of traffic generated by someone else. For households, that means an infected box may expose the home connection to misuse without obvious signs on the TV screen. For businesses, compromised home or office devices can also complicate security monitoring: an IP address that appears to belong to a normal user may be carrying traffic controlled by an outside operator.
Google said the disruption also targeted control servers used by other malware families found on the boxes. It estimates this could cut off access to at least 10 million additional compromised devices. That is Google’s estimate of a wider effect, not a direct count of devices affected by XCPE, and the source material says those devices do not all run Android.
Products Worth Considering
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
Samsung Odyssey G4 25-inch FHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Firmware Backdoor Persisted
GTIG’s report, titled “Shutting the Door on the XCPE Botnet,” says the backdoor was part of the devices’ firmware and used system-level privileges. In Google’s account, the app contacted a control server when a box started, received settings and maintained a connection that allowed commands and additional software to be delivered. Google also says the backdoor disabled Google Play Protect checks before installing other apps.
The arrangement allowed Videostrong, according to Google, to supply access to criminal partners whose software modules carried out different activities. The botnet’s main reported uses were residential proxy services and advertising fraud. Google says the modular design had developed since at least late 2024; it also reported that new droppers disguised as Android system apps appeared in August 2026.
Google announced several responses: legal action to take down the relevant domains and servers, a ban preventing Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and tighter firmware-integrity checks for certified Android TV products. The supplied reporting says Google did not publish the court filing, and no public case record was identified there.
“The backdoor and the botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group, in its report “Shutting the Door on the XCPE Botnet”
What the Disruption Did Not Remove
The disruption targeted control servers and domains; it did not remove the backdoor from device firmware. Google’s account says the backdoor can reinstall after a reboot, so an app uninstall or the loss of the original control infrastructure should not be treated as proof that a box is clean. The supplied material does not establish how many affected devices remain connected or whether every control path has been disabled.
Google’s accusation against Videostrong is a company assessment. Videostrong did not respond to requests for comment from The Record and heise, according to the source material. Google has not published the court filing cited there, and no public case details, such as a court or case number, are provided. The precise number of devices affected by each add-on malware family, and the scale of resulting harm to individual owners, also remain unclear.
Checks for Owners and Vendors
Google says it has banned Videostrong from certified Android production and changed its firmware review process. The company’s next stated focus is stronger integrity checks for certified Android TV devices. The supplied information does not give a schedule for those checks or describe how owners of affected boxes will receive device-specific alerts or remediation.
Google’s guidance, as summarized in the source material, is to check whether a box has Play Protect certification and be cautious with no-name or “unlocked” devices. If a device appears suspicious, owners can unplug or replace it and place TV boxes on a separate guest network. Because the backdoor may persist in firmware, removing an app alone may not resolve the problem. Businesses should treat connected devices as part of their security exposure rather than relying only on the reputation of an IP address.
Key Questions
What happened to the XCPE botnet?
Google and partners said they disrupted the botnet’s control infrastructure in late October 2026. Google announced the operation on Nov. 2, saying XCPE involved more than 1.3 million set-top boxes.
Who does Google say was responsible?
Google’s Threat Intelligence Group says Shenzhen-based manufacturer Videostrong Technology Co. built and operated the firmware backdoor for profit. Videostrong did not respond to requests for comment cited in the supplied source material, and the source does not provide a public court filing.
Does the takedown remove malware from an affected TV box?
No. The action disrupted control servers, but Google says the backdoor remains in firmware and can reinstall after a reboot. The supplied material says deleting the app does not remove it.
How many devices were counted?
Google reported more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, and described its count as a lower bound.
What should owners do if they are concerned?
Check the device’s Play Protect certification, avoid untrusted or no-name boxes, and consider unplugging or replacing a suspicious device. Keeping TV boxes on a separate guest network can limit their access to other devices, but it does not remove a firmware backdoor.
Source: ThorstenMeyerAI.com
