🔍 Read the full analysis: What Google’s TV Box Botnet Takedown Means For Device Security on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google said on Nov. 2 that it and industry partners, working with Japan’s National Police Agency, disrupted the control infrastructure for XCPE, a botnet involving more than 1.3 million set-top boxes. Google attributes the operation to device maker Videostrong, but the backdoor remains in affected firmware and can return after a reboot; the takedown cut off remote control, not necessarily the infection.
Google and its partners disrupted the control infrastructure for XCPE, a botnet tied to more than 1.3 million Android set-top boxes, the company said Nov. 2. Google alleges that Shenzhen-based manufacturer Videostrong Technology built and operated a firmware backdoor for profit; the intervention cut the operators’ remote access, but Google’s report says the backdoor can persist on affected devices.
Google’s Threat Intelligence Group said it worked with security companies and Japan’s National Police Agency to take action against XCPE in late October. The measures included legal action to disrupt domains and servers used to control the botnet and deliver malware, as well as control servers linked to more than a dozen malware families that had been loaded onto devices as add-ons. Google also barred Videostrong and any future subsidiaries or affiliates from making certified Android devices or supplying software to certified vendors, and said it had tightened firmware-integrity checks for certified Android TV devices.
The device count has more than one published measure. Google described the botnet as involving more than 1.3 million set-top boxes. Security partner TrendAI reported 1,472,554 infected devices observed between June 3 and Oct. 1, 2026, calling its figure a lower bound. Google also estimated that disruption of the add-on malware’s control servers could cut access to at least 10 million additional compromised devices. That is an estimate, not a verified count, and the additional devices were not all necessarily Android devices.
According to Google, infected boxes were used mainly as residential proxies—routing other people’s online traffic through a household’s internet connection—and for ad fraud. The company also reported capabilities to capture live screenshots, simulate keystrokes, collect account and device data, and open remote shells. Those functions indicate potential access beyond passive use of a home connection, though the source material does not establish how often each capability was used or what data was actually taken.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Why Firmware Access Changes the Risk
The case shifts the security question from whether a user downloaded a bad app to whether a device was compromised before purchase. Google says the backdoor was built into firmware and could run with system-level privileges. If that account is accurate, ordinary app removal or cautious clicking would not address the initial compromise: the code was already present in the device software.
For households, a proxy can make a stranger’s activity appear to come from the home’s internet address. That can expose the connection to misuse and complicate efforts to distinguish a household’s own traffic from activity routed through its equipment. For businesses, compromised consumer and office devices can create a route into networks or make malicious activity harder to trace. The report’s description of remote commands and local-network scanning makes network separation relevant, although it does not say that every infected box accessed other devices.
The episode also bears on device certification. Google says some affected products were certified and alleges Videostrong used obfuscation to pass checks by loading malicious code after a device’s first boot. Certification can offer a useful signal, but this case shows it is not a guarantee that firmware will remain safe or that every component has been fully assessed.
Products Worth Considering
Apple MacBook Air 15-inch with M5 chip, 24GB RAM, 512GB SSD, Midnight
Apple MacBook Neo 13-inch Laptop with A18 Pro Chip, 8GB Memory, 512GB SSD, Liquid Retina Display, and Touch ID (Blush)
Apple MacBook Pro 2023 16.2 M2 Max 32GB 1TB SSD Space Gray
As an affiliate, we earn on qualifying purchases.
How XCPE Reached the Boxes
Google’s Nov. 2 report, titled Shutting the Door on the XCPE Botnet, describes a small system app called x.cpe, also identified in some builds as com.oemservice. Google says it was embedded in firmware with system-level rights. The app contacted a control server, received settings and maintained a connection through which operators could issue commands and install additional software.
Google says that if users removed the app, it could reinstall from a protected partition after a reboot. The report describes the botnet as layered: a component communicating with the server, a separate loader, and modules supplied by affiliates. Google says the design had at least three layers by late 2024, and that new droppers disguised as Android system apps appeared in August 2026.
Google attributes the development and operation of the backdoor and botnet to Videostrong, a manufacturer that builds devices for its own brand and for other companies. It says affiliates supplied malware modules used for activities such as proxy services and ad fraud. The report names law enforcement and security partners including Lumen, HUMAN Security, Plume, Synthient and TrendAI. Videostrong did not respond to requests for comment from The Record and heise, according to the supplied source material.
“The backdoor and the botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Did Not Remove
The disruption targeted control servers and domains; it did not, according to Google’s account, remove the backdoor from device firmware. Google says the component can reinstall after reboot, so a box that has lost contact with the operators may still contain persistent malicious code. The source material does not identify a remote remediation method that owners can use to clean the firmware safely.
Other details remain unresolved. The supplied reporting does not include a public court filing, court name or case number, and Videostrong did not respond to the cited media requests. It is also unclear how many affected devices remain in use, how many were certified, how many users’ data was accessed, or whether every reported capability was exercised. Google’s estimate of at least 10 million additional compromised devices is not a confirmed count, and its device mix is not fully specified.
TrendAI’s figure covers observations from June 3 to Oct. 1, 2026; it should not be treated as a count of all infected devices over the botnet’s full life. The available material also does not give a complete list of affected models, brands or firmware versions, leaving owners without a definitive public inventory to check against.
Steps for Owners and Network Teams
Google said it has changed its firmware review process and barred Videostrong from participating in its certified Android device program. The effectiveness of those measures will depend on how the revised checks detect code that is activated after initial setup. The company and its partners may also provide further technical details or affected-device information; the supplied reports do not specify a date for additional disclosures.
Owners can check whether a device is Play Protect certified in its settings or through Google’s Play Store certification information, but certification status alone cannot establish that a box is unaffected. The source material advises treating suspicious, no-name or “unlocked” boxes as untrusted: disconnecting or replacing the device is safer than relying on an app uninstall when the firmware backdoor may persist. Owners should also avoid using such a device for sensitive accounts or network access until its status is clear.
Households and organizations can reduce exposure by placing streaming boxes and other internet-connected devices on a separate guest or IoT network, limiting their access to computers and shared storage. Network teams should not rely on IP reputation alone: proxy traffic can originate from ordinary residential connections. The next practical milestone is clearer guidance on affected models and whether manufacturers can provide a verified firmware fix; until then, the number of boxes still exposed remains unknown.
Key Questions
What happened to the XCPE botnet?
Google said it and industry partners, working with Japan’s National Police Agency, disrupted XCPE’s control infrastructure in late October 2026. The action targeted domains and servers used to control infected devices and distribute malware.
How many TV boxes were involved?
Google described the botnet as involving more than 1.3 million set-top boxes. TrendAI reported 1,472,554 infected devices observed between June 3 and Oct. 1, 2026, and called that count a lower bound.
Does the takedown remove malware from an infected box?
Not necessarily. Google says the backdoor remains in firmware and can reinstall itself after a reboot. The takedown cut off remote control infrastructure; the supplied material does not describe a confirmed owner-accessible cleanup method.
What could infected boxes do?
Google said they were used mainly as residential proxies and for ad fraud. It also reported that operators could capture screenshots, simulate keystrokes, collect account and device data, and open remote shells, but did not quantify how often each capability was used.
What should owners do if they are concerned?
Check the device’s Play Protect certification, but do not treat certification as proof that a box is unaffected. If a device seems suspicious, disconnecting or replacing it is safer than merely uninstalling apps; placing TV boxes on a separate guest network can also limit access to other devices.
Source: ThorstenMeyerAI.com
