🔍 Read the full analysis: The Malware On TV Boxes That Led Google To A 1.3-Million-Device Botnet on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google said on Nov. 2 that it and industry partners had disrupted the XCPE botnet, which Google says involved more than 1.3 million set-top boxes. Google alleges that manufacturer Videostrong built and operated a firmware backdoor for profit; the company did not respond to media requests cited in the source report. The takedown severed control servers, but the backdoor remains in infected devices and can reinstall after a reboot.
Google said on Nov. 2 that it had worked with security partners and Japan’s National Police Agency to disrupt the XCPE botnet, which Google says involved more than 1.3 million Android set-top boxes. Google alleges that Shenzhen-based manufacturer Videostrong Technology built and operated a backdoor in device firmware for financial gain, turning boxes owners used for streaming into tools for proxy traffic and ad fraud.
Google’s Threat Intelligence Group said the operation cut off the botnet’s control servers and domains in late October. The company also said legal action targeted control servers used by more than a dozen malware families found as add-ons on affected boxes. Google worked with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI.
Google said it had high confidence that Videostrong developed, deployed and operated the backdoor and sold access to criminal partners. TrendAI separately counted 1,472,554 infected devices from June 3 to Oct. 1, 2026, describing its count as a lower bound. That figure has a defined measurement period and comes from a partner’s tracking; Google’s public estimate was more than 1.3 million boxes.
The backdoor, identified in some builds as x.cpe or com.oemservice, was embedded in firmware with system-level privileges, according to Google. The company said infected boxes could be used as residential proxies and for ad fraud. It also observed operators taking screenshots, injecting keystrokes, collecting account and device information, and opening remote shells. These capabilities describe what Google observed or reported, not proof that every infected box was used for every function.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Why Infected TV Boxes Matter
The case matters because the alleged compromise occurred before owners bought the devices. Users did not necessarily need to click a malicious link or install a fake app: Google says the backdoor was placed in firmware by the manufacturer. That makes ordinary steps such as removing an unfamiliar app less reliable as a remedy.
Residential proxy software can route another party’s internet activity through a household’s connection, making that activity appear to originate from the home’s IP address. Google also reported ad-fraud activity and broader remote-control capabilities. For users, that can mean their network is used without consent; for organizations, compromised consumer or office devices may complicate efforts to identify where suspicious traffic originates.
Google said Videostrong and future subsidiaries or affiliates were barred from building certified Android devices or supplying software to certified vendors. It also said it tightened firmware-integrity checks. Those actions address access to Google’s certification program, but they do not remove firmware already installed on devices in people’s homes.
Products Worth Considering
Apple iMac 27-inch Retina 5K Display (2020, 8GB RAM, 512GB SSD)
Apple MacBook Neo 13-inch Laptop with A18 Pro Chip, 8GB Memory, 512GB SSD, and Touch ID – Blush
Apple Mac mini Desktop Computer with M6 Chip (2026)
As an affiliate, we earn on qualifying purchases.
How the Firmware Backdoor Persisted
Google’s report describes a system app installed in a protected firmware partition. It contacted a control server when the box started, retrieved instructions and maintained a connection for further commands. According to Google, the app could reinstall itself after a reboot if a user removed it, so uninstalling an app would not necessarily clean an affected device.
Google said the malware’s design had developed into separate layers: a small component communicating with the server, a loader, and modules supplied by affiliates. The modules enabled different forms of monetization. Google also said some affected boxes were Google-certified; it alleges Videostrong used obfuscation and delayed loading of malicious code until after first boot to evade checks.
TrendAI’s device count covers June 3 through Oct. 1, 2026. Google’s report, titled “Shutting the Door on the XCPE Botnet,” was published Nov. 2. Google also estimated that disabling control servers for add-on malware could cut access to at least 10 million additional compromised devices. That is an estimate of potential reach, not a verified count of devices, and the source report says those devices do not all run Android.
“The backdoor and the botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Did Not Remove
The control-server disruption does not, by itself, remove the backdoor from device firmware. The source report says the component can return after reboot, and does not describe a remote cleanup method that permanently removes it. It is therefore unclear how many affected boxes remain in use or whether their owners have been notified.
Google’s public report, as summarized in the source material, does not include a court name or case number. Videostrong did not respond to requests for comment from The Record and heise, according to that report. The company’s account of the allegations and any legal response are not available here. The precise number of devices still reachable after the takedown is also not stated.
Google’s estimate concerning at least 10 million additional compromised devices is not a confirmed device-by-device tally. The source material says the malware spread through other channels and that the devices in that estimate do not all run Android. The estimate’s full counting method is not provided here.
Steps for Owners and Google
Google said it had banned Videostrong from its certified Android device program and changed its firmware-review process. The company has not provided, in the source material, a schedule for further technical updates or a list of affected models. Owners should check whether a box is Play Protect-certified, be cautious with no-name or “unlocked” devices, and contact the seller or manufacturer for device-specific guidance.
Because Google says the backdoor can persist in firmware, people who suspect a box is affected should treat it as untrusted rather than relying on an app uninstall. The source report recommends unplugging or replacing a suspicious device and placing TV boxes on a separate guest network. Businesses can limit exposure by isolating connected devices and not treating an IP address’s apparent reputation as sufficient proof that traffic is safe.
Further clarity would depend on device-level identification, any manufacturer response, and additional information from Google or law enforcement. Until then, the reported server disruption should be understood as cutting off remote control infrastructure—not confirmation that every infected device has been cleaned.
Key Questions
What happened to the XCPE botnet?
Google said it and partners disrupted XCPE’s control servers and domains in late October 2026. Google reported that the botnet involved more than 1.3 million set-top boxes.
Who does Google say was behind the backdoor?
Google’s Threat Intelligence Group alleges that Videostrong Technology Co. built and operated the firmware backdoor for financial gain. Videostrong did not respond to media requests cited in the source report.
Does the takedown remove malware from an infected box?
Not necessarily. The source report says the backdoor remains in firmware and can reinstall after a reboot. Cutting off control servers is not the same as cleaning each device.
How can owners reduce risk?
Check the box’s Play Protect certification, avoid untrusted no-name devices, and isolate TV boxes on a guest network. If a device seems affected, the source report recommends treating it as untrusted, unplugging or replacing it rather than relying on an app uninstall.
Source: ThorstenMeyerAI.com
