🔍 Read the full analysis: Google’s TV Box Botnet Takedown: What The Factory Malware Story Shows on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google and industry partners disrupted the control infrastructure for XCPE, a botnet involving more than 1.3 million set-top boxes, according to reports published on Nov. 2, 2026. Google says the backdoor was built into firmware by device maker Videostrong; the takedown cuts off control servers but does not remove the persistent malware from affected boxes.
Google and its partners disrupted the control infrastructure for the XCPE botnet in late October, a network involving more than 1.3 million Android set-top boxes that Google says were infected through factory firmware. In a report published Nov. 2, Google’s Threat Intelligence Group accused device maker Videostrong Technology Co. of developing and operating the backdoor for profit; the company’s alleged role has not been independently established in a public court record cited in the source material.
Google said it worked with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI to disrupt the botnet. The actions included legal measures targeting domains and servers used to control XCPE and distribute malware, as well as control servers for more than a dozen other malware families found as add-ons on the boxes. Google also said it barred Videostrong and its future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and tightened firmware-integrity checks for certified Android TV devices.
The reported device counts come from different sources and time frames. Google described the network as involving more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, calling its figure a lower bound. Google separately estimated that shutting down control servers for the add-on malware could cut off access to at least 10 million additional compromised devices. That is an estimate, not a verified device count, and the source material says not all of those devices run Android.
Google said infected boxes were used mainly as residential proxies, routing other people’s internet traffic through owners’ connections, and for ad fraud. Its report also describes capabilities including taking live screenshots, injecting keystrokes, collecting account and device information, opening remote shells and installing apps without user approval. The source says the backdoor could disable Google Play Protect checks before installing additional software.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
A Factory Backdoor Changes the Risk
The case matters because it shifts the infection route from a user clicking a malicious link to malicious code placed in device firmware before sale. If Google’s account is accurate, ordinary precautions such as avoiding suspicious downloads may not protect an owner whose box arrived with a system-level backdoor already installed. The affected device can also expose the home internet connection to outside traffic, potentially making activity appear to come from the household.
The reported persistence makes the distinction between disrupting a botnet and cleaning a device important. Google’s action targeted the control servers and related infrastructure; according to the source material, the backdoor remains in firmware and can reinstall itself after a reboot. Removing an app therefore may not eliminate the underlying access. The available report does not establish how many devices remain active or what remediation is possible for every model.
The incident also raises questions for device certification and supply-chain oversight. Google says some affected boxes were certified, and that Videostrong used obfuscation to load malicious code after a device’s first boot, evading checks. The reported response includes revised firmware review procedures, but the source material does not provide details of the new tests or their results.
Products Worth Considering
Apple MacBook Pro 14.2-inch with M5 Max, 18-core CPU, 32-core GPU, 36GB Memory, 2TB SSD, Wi-Fi 7, Silver
Apple MacBook Air 15-inch with M5 chip, 16GB Memory, 512GB SSD, and Liquid Retina Display
Apple MacBook Pro 14 2021 with M1 Max, 64GB RAM, 2TB SSD, Silver
As an affiliate, we earn on qualifying purchases.
How XCPE Reached Set-Top Boxes
Google’s report, titled “Shutting the Door on the XCPE Botnet,” says the backdoor was a small system app identified in some builds as x.cpe or com.oemservice. It had system-level access and was stored in firmware. Google said that after a box started, the software contacted a control server for instructions and maintained a connection that allowed operators to send commands and install additional components.
The report describes a modular setup in place since at least late 2024: a component communicating with the server, a separate loader and money-making modules supplied by affiliates. Google also reported new droppers disguised as Android system apps in August 2026, which it interpreted as an effort to maintain concealment. These technical findings and the attribution to Videostrong are claims in Google’s report, not findings presented in a publicly available court judgment in the supplied material.
Google said its response included legal action against the domains and servers used to control XCPE and push malware. The source material says Google did not publish the court filing and that no public case record was located by its author. Videostrong did not respond to requests for comment from The Record and heise, according to the source material.
““The backdoor and the botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
The Backdoor May Still Remain
The takedown’s effect on devices already infected is not fully described in the source material. Google’s infrastructure actions disrupted remote control, but the reported backdoor remains in firmware and can reinstall after reboot. The material does not say whether affected owners will receive a firmware update, whether every device model can be cleaned, or how many boxes still connect to any functioning infrastructure.
Some key claims also remain difficult to verify independently from the supplied reporting. Google attributed the operation to Videostrong with “high confidence,” but no public court filing or case record is provided there, and Videostrong did not respond to requests for comment reported by The Record and heise. The figure of at least 10 million additional devices is Google’s estimate; its counting method and the precise number of Android devices in that group are not stated.
The source material does not give a complete list of affected brands or models. It also does not specify the number of certified devices affected, how many owners experienced measurable harm, or whether account information collected from boxes was used. Those questions should not be treated as resolved by the control-server takedown.
Firmware Fixes and Device Checks
Google says it has changed firmware-integrity checks for certified Android TV devices and barred Videostrong and future affiliates from participation in its certified-device program. Further details about those checks, any updates for affected devices and the legal actions may clarify how the company intends to address the persistent firmware component. The source material gives no timetable for those steps.
For owners, the report advises checking whether a box is Play Protect certified and being cautious with no-name or “unlocked” devices. Because the reported backdoor can survive an app uninstall and reboot, owners who suspect an affected box can treat it as untrusted, disconnect or replace it, and keep TV boxes on a separate guest network. The report also advises businesses to include home and office internet-connected devices in security planning rather than relying only on IP reputation to identify suspicious traffic.
Key Questions
What happened to the XCPE botnet?
Google says it and its partners disrupted XCPE’s control infrastructure in late October 2026. Google described the botnet as involving more than 1.3 million set-top boxes infected through a firmware backdoor.
Who does Google say was behind the backdoor?
Google’s Threat Intelligence Group attributed the backdoor to Videostrong Technology Co., saying it had high confidence the manufacturer developed and operated it for profit. That attribution is Google’s claim; the supplied material does not identify a public court judgment establishing it.
Does the takedown remove malware from an infected box?
Not necessarily. The source material says the takedown disrupted control servers, while the backdoor remains in firmware and can reinstall after a reboot. It says uninstalling the app alone does not remove it.
How can an owner check a TV box?
Google’s report advises checking the device’s Play Protect certification and being wary of no-name or “unlocked” boxes. If a device is suspected of infection, the source recommends treating it as untrusted, disconnecting or replacing it, and placing TV boxes on a separate guest network.
Source: ThorstenMeyerAI.com
