🔍 Read the full analysis: Google Takes Down A 1.3-Million-Device TV Box Botnet Linked To Factory Malware on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google and security partners disrupted the control infrastructure for XCPE, a botnet involving more than 1.3 million set-top boxes, the company said on November 2, 2026. Google says the backdoor was embedded in firmware by device maker Videostrong; the disruption cuts off remote control but does not remove the malware from affected boxes.
Google and its partners disrupted the control infrastructure for XCPE, a botnet linked to more than 1.3 million set-top boxes, the company said November 2. Google alleges that Shenzhen-based manufacturer Videostrong Technology Co. embedded a backdoor in device firmware for financial gain, allowing operators to use affected boxes for residential proxy traffic, ad fraud and other remote activity.
Google’s Threat Intelligence Group said it worked with Japan’s National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google says the partners acted in late October to take down domains and servers used to control the botnet and distribute malware. It also pursued legal action against servers associated with more than a dozen malware families that had been installed as add-ons.
The scale figures have different sources and measures. Google described the botnet as involving more than 1.3 million set-top boxes. TrendAI separately counted 1,472,554 infected devices between June 3 and October 1, 2026, and characterized its total as a lower bound. Google also estimates that actions against the add-on malware’s control servers may cut off access to at least 10 million other compromised devices. That is an estimate, not a confirmed device count, and those devices do not all necessarily run Android.
Google says infected boxes were used mainly as residential proxies, routing third-party internet traffic through owners’ connections, and for ad fraud. The company also observed capabilities including remote screenshots, keystroke injection, collection of account and device information, and remote shell access. The extent to which each capability was used on individual devices has not been made public.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
The Risk of Factory-Installed Backdoors
The case shifts attention from malicious apps downloaded by users to software embedded before a device is sold. When a backdoor is part of firmware, ordinary precautions such as avoiding suspicious links or uninstalling an unfamiliar app may not be enough. Google says the XCPE backdoor can reinstall itself after a reboot, so the server disruption does not by itself clean affected devices.
Compromised home connections can also serve as cover for traffic generated by others. That may expose owners to service problems or scrutiny when activity appears to come from their internet address, although the supplied reports do not describe specific legal consequences for individual owners. For organizations, the incident is a reminder that inexpensive connected devices on home or office networks can be part of a broader security exposure.
Some affected boxes were reportedly Google-certified Android devices. Google says Videostrong delayed loading the malicious code until after initial setup to evade checks. That raises questions about firmware review and certification, though Google says it has responded by barring Videostrong from certified Android device production and tightening firmware integrity checks.
Products Worth Considering
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
Samsung 34-Inch Odyssey G5 Ultra-Wide Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
Google’s November 2 report, titled “Shutting the Door on the XCPE Botnet,” describes the backdoor as a system app included in device firmware. It was identified in some builds as x.cpe and in others as com.oemservice. Google says it had system-level privileges, contacted a control server when the box started and could receive instructions to install additional software or run commands.
According to Google, the malware could restore itself from a protected partition if removed and the device rebooted. The company says it also disabled Google Play Protect checks before installing other software. The botnet’s design included a component that communicated with the server, a loader and separate modules used to generate revenue. Google says new droppers disguised as system apps appeared in August 2026.
Google attributes the backdoor’s development and operation to Videostrong with “high confidence.” The company said Videostrong and future subsidiaries or affiliates are barred from building certified Android devices or supplying software to certified vendors. The supplied reporting says Videostrong did not respond to requests for comment from The Record and heise. The allegations have not been accompanied here by a publicly available court filing or case number.
““The backdoor and the botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Disruption Did Not Remove
The server takedown is not the same as removing malware from every affected box. Google’s account says the backdoor remains in firmware and can reinstall itself after reboot; the supplied material does not identify a universal cleanup method or say how many owners have replaced affected devices. It is also unclear how many boxes remain online or whether operators have established replacement control infrastructure.
The full evidence behind Google’s attribution to Videostrong has not been made public in the material provided. No public court record or case number is cited. The precise number of devices affected, the number of owners notified, and the impact on individual users also remain unclear. Google’s estimate of at least 10 million additional compromised devices is an estimate of access disrupted through related malware servers, not a verified count of XCPE boxes.
Firmware Checks and Owner Response
Google says it has changed its review process to strengthen checks on firmware integrity for certified Android TV devices and has barred Videostrong from the certified Android ecosystem. The company has not specified in the supplied material when those checks will be fully applied or published results from them. Further details from Google, partner firms or law enforcement could clarify the legal action, the affected device models and whether additional control servers remain active.
Owners can check a box’s Play Protect certification, but certification alone may not establish whether a device is affected. Google’s account indicates that uninstalling an app may not remove a firmware-level backdoor. People who suspect a box is compromised can disconnect it from the network and consider replacing it; keeping streaming devices on a separate guest network can limit their access to other devices. Businesses should account for connected devices on office and home networks and avoid relying only on an IP address’s reputation when evaluating suspicious traffic.
Key Questions
What did Google take down?
Google says it and its partners disrupted the domains and servers controlling XCPE in late October. The action targeted remote control and malware distribution; it did not necessarily remove malware from the boxes.
How many devices were affected?
Google described XCPE as involving more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and called that a lower bound. The figures reflect different reporting and measurement details.
Does the takedown clean an infected TV box?
No. Google says the backdoor remains in the firmware and can reinstall itself after a reboot. The supplied information does not give a universal removal procedure.
What should owners do if they are concerned?
Check the device’s Play Protect certification, disconnect a box suspected of being compromised, and consider replacing it. Keeping streaming devices on a separate guest network can reduce their access to other devices, but it does not remove firmware malware.
Source: ThorstenMeyerAI.com
