🔍 Read the full analysis: The Factory Malware Behind A 1.3-Million-Device TV Box Botnet on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google and industry partners disrupted the control infrastructure for XCPE, a botnet linked by Google to Shenzhen-based device maker Videostrong. Google says the operation involved more than 1.3 million set-top boxes, but the firmware backdoor can remain after the takedown and reinstall itself when a device reboots.
Google says it and its partners disrupted XCPE, a botnet involving more than 1.3 million Android set-top boxes, after identifying a backdoor that the company says was installed in device firmware by manufacturer Videostrong Technology. The operation cut off control servers, but Google says the backdoor can remain on affected boxes and reinstall after a reboot.
Google’s Threat Intelligence Group (GTIG) published its account on November 2, saying the operation was carried out with industry partners and Japan’s National Police Agency. The work included legal action to take down domains and servers used to control XCPE and distribute malware. Google also said it acted against control servers for more than a dozen malware families that had been loaded onto devices as add-ons.
Google described Videostrong, a Shenzhen-based Android device maker, as responsible for developing and operating the backdoor for financial gain. It said it had high confidence in that assessment. Google says Videostrong has been barred from building certified Android devices or supplying software to certified vendors, and that it has tightened firmware-integrity checks for certified Android TV products. The company did not respond to comment requests cited by The Record and heise, according to the source report.
The infected boxes were used mainly as residential proxies, routing third-party internet traffic through owners’ home connections, and for ad fraud, according to GTIG. Google also reported capabilities to capture live screenshots, inject keystrokes, collect account and device data, open remote shells and scan local networks. Partner TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, describing its total as a lower bound. Google’s broader figure is more than 1.3 million set-top boxes.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
The Backdoor Outlasts the Takedown
The disruption limits the operators’ ability to communicate with infected devices through the identified control infrastructure, but it does not by itself clean the boxes. GTIG says the malware component is embedded in firmware with system-level privileges and can restore itself from a protected partition after a reboot. Removing an app through the usual interface may not remove that persistent component.
The case also affects how users and organizations judge traffic from ordinary-looking devices. A home or office connection can become a route for other people’s activity without its owner’s knowledge. For businesses, that can complicate security monitoring: traffic coming from a residential or office IP address does not, by itself, establish that the connection is trustworthy. Google’s report also points to a supply-chain concern, because it says the malicious code was placed in firmware before the devices reached buyers.
Google said the takedown of add-on malware control servers could cut off access to at least 10 million additional compromised devices. That figure is an estimate of potential impact, not a confirmed count of devices cleaned or disconnected, and the affected devices are not all necessarily Android products.
Products Worth Considering
Samsung 34-Inch Odyssey G5 Ultra-Wide Curved Gaming Monitor
Samsung Odyssey G4 25-inch FHD Gaming Monitor
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How XCPE Reached the Boxes
According to GTIG, the backdoor appeared as a small system app, identified in some builds as x.cpe and in others as com.oemservice. It was placed in firmware and ran with system-level privileges. The report says it contacted a control server when the device started, received settings and maintained a connection that could be used to deliver commands or additional software.
Google said the operators used obfuscation to evade its certification checks, including by loading malicious code after the device’s first boot. Some affected boxes were Google-certified, the company said. GTIG described a multi-part design in use since at least late 2024, with a communication stub, a separate loader and revenue-generating modules supplied by affiliates. In August 2026, Google observed new droppers disguised as Android system apps replacing the loader.
Google worked with Lumen, HUMAN Security, Plume, Synthient and TrendAI as well as Japan’s National Police Agency. Its response included both action against the XCPE infrastructure and measures aimed at related malware servers. Google’s public report describes the legal steps but does not provide a court filing or case number.
““The backdoor and the botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Cannot Confirm
Google’s account does not identify every affected device model, brand or owner, and the supplied source material does not include a complete list of products containing the firmware. It is also unclear how many boxes remain online, how many have been cleaned or replaced, and whether operators have established new control infrastructure since the disruption.
The source material does not include a public court filing, case number or court, so the precise legal basis and status of the actions cannot be independently detailed here. Google’s claim about Videostrong is its assessment; Videostrong’s response was not available in the cited reporting. The projected effect on at least 10 million additional devices is an estimate, not a measured total of devices remediated.
Owners may not be able to identify infection from ordinary use. Google says the backdoor can survive app removal and return after reboot, meaning an apparently normal interface or a deleted app is not proof that a box is clean.
Checks for Owners and Organizations
Google says it has changed its checks for firmware integrity on certified Android TV devices and barred Videostrong from participating in its certified-device ecosystem. The company has not stated in the supplied material how many products or users will receive a direct warning, or whether affected devices can be repaired through a reliable firmware update.
Owners can check whether a device is Play Protect certified and review its manufacturer and model details, but certification alone may not rule out a compromised device: Google says some infected boxes were certified. A suspicious or unknown-brand box should be treated as untrusted. Unplugging or replacing it, and keeping streaming devices on a separate guest network, can limit exposure while more device-specific guidance is unavailable.
Organizations should inventory TV boxes and other connected devices on home and office networks, restrict their access to internal systems, and avoid relying on IP reputation alone to judge whether network traffic is safe. Further reporting will depend on additional information from Google, law enforcement, affected manufacturers and security partners about device identification, remediation and any renewed activity.
Key Questions
What was the XCPE botnet?
XCPE was a network of compromised Android set-top boxes. Google says the boxes could be used as residential proxies and for ad fraud, with additional capabilities including screenshots, keystroke injection and remote commands.
How many devices were affected?
Google said the botnet involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and described its count as a lower bound.
Does the takedown remove the malware from a TV box?
Not necessarily. Google says the action disrupted control servers, while the backdoor can remain in firmware and reinstall itself after a reboot. Removing an app through the device interface may not remove it.
How can owners reduce the risk?
Check the device’s certification and manufacturer information, but do not treat certification as a guarantee because Google says some infected boxes were certified. Consider unplugging or replacing a suspicious device and placing streaming boxes on a separate guest network.
Has Videostrong responded to the allegation?
The source material says Videostrong did not respond to comment requests reported by The Record and heise. Google’s account is an attributed assessment, and no public court filing or case number was supplied.
Source: ThorstenMeyerAI.com
