🔍 Read the full analysis: Google Takes Action Against A TV Box Botnet Linked To Factory Malware on ThorstenMeyerAI.com
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google and industry partners disrupted control of the XCPE botnet in late October, following a Nov. 2 report that more than 1.3 million TV boxes were involved. Google says Shenzhen-based Videostrong built and operated the firmware backdoor for profit; the company did not respond to media requests cited by the source report. The disruption cuts off the botnet’s control servers, but the backdoor may remain on infected boxes and reinstall after a reboot.
Google and industry partners disrupted the control infrastructure of the XCPE botnet in late October, after the company said a backdoor embedded in Android TV-box firmware had affected more than 1.3 million set-top boxes. In a report published Nov. 2, Google attributed the operation to Shenzhen-based manufacturer Videostrong Technology Co., alleging that it built and ran the backdoor for financial gain.
Google’s Threat Intelligence Group (GTIG) said it worked with Japan’s National Police Agency and security companies to take down domains and servers used to control XCPE and distribute malware. Google also pursued action against control servers associated with more than a dozen malware families found as add-ons on the devices. The source report says Google did not publish the relevant court filing, and it found no public case record; the legal action’s court and case number are not available in the material.
The reported device totals use different measures. Google described the botnet as involving more than 1.3 million boxes. Partner TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, calling its figure a lower bound. Google said shutting down the add-on malware’s control servers could also cut off access to at least 10 million additional compromised devices. That is an estimate, not a confirmed device count, and the source report says those devices do not all run Android.
According to GTIG, the boxes were used mainly as residential proxies, routing other people’s internet traffic through owners’ home connections, and for ad fraud. Google also observed operators taking screenshots, injecting keystrokes, collecting account and device information, and opening remote shells. Those capabilities describe what the operators could do; the report does not establish that every infected box was used for every activity.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Why the Firmware Backdoor Matters
Google says the backdoor was built into device firmware before the boxes reached customers, rather than installed through a later user action. If accurate, that means buyers could receive a compromised product without clicking a malicious link or installing an unfamiliar app. Users may not know their internet connection is being used by someone else.
Residential-proxy abuse can make harmful or deceptive traffic appear to originate from a household or office connection. The reported remote-access functions could also expose device and account data or allow access to networks the box can reach. The source material does not report specific downstream damage to individual users, so these are potential risks, not confirmed incidents.
Google’s account that the backdoor can persist in firmware means removing an app may not remove it. Google’s actions target the botnet’s infrastructure and Videostrong’s access to certified Android devices; the supplied information does not describe a remote cleanup of infected boxes.
Products Worth Considering
Amazon Kindle Paperwhite (2024), 16 GB, 7-inch Display, Black
Amazon Kindle Paperwhite Signature Edition, 32GB (2024), Metallic Black
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
GTIG’s report, titled “Shutting the Door on the XCPE Botnet,” describes a system app named x.cpe, or com.oemservice in some builds. Google says it was placed in firmware with system-level privileges and communicated with a control server when the box started. The report says that if a user removed the app, it could be restored from a protected partition after a reboot.
Google said the backdoor could fetch instructions and enable operators to install software silently, run commands, capture screens, and scan a local network. The source material says the system also disabled Google Play Protect checks before installing add-on software. Since at least late 2024, GTIG says, the design had separate components for server communication, loading code, and running money-making modules. Google also identified new droppers disguised as Android system apps in August 2026.
Some affected boxes were Google-certified, according to the source report. Google said Videostrong used obfuscation to evade checks by loading malicious code after a device’s first boot. In response, Google banned Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and said it had tightened firmware-integrity checks for certified Android TV devices.
““more than 1.3 million set-top boxes””
— Google Threat Intelligence Group, as quoted in its report
What the Takedown Cannot Confirm
The number of devices still compromised is unclear. The supplied material gives Google’s broad estimate and TrendAI’s time-bounded count, but not a final count of unique boxes that remain infected after the disruption. It also does not say how many users received affected models or identify all brands and model numbers involved.
The source report says the backdoor remains in firmware and can reinstall after a reboot, but it does not establish how many devices still have a functioning connection to the operators after the server takedown. Nor does it provide a detailed public account of what happened to user data, whether specific accounts were accessed, or whether all listed capabilities were used on affected devices.
Google’s attribution is an allegation by the company. The source material says Videostrong did not respond to requests for comment from The Record and heise. It does not include a response from the manufacturer or public court documents that would independently detail the legal action. Those gaps limit what can be concluded about the company’s account and the precise scope of the enforcement measures.
Device Checks and Google’s Follow-Up
Google has said it changed its review process to strengthen checks on firmware integrity for certified Android TV devices. The source material does not give a timetable for further actions or describe a process that removes the backdoor from boxes already sold. The effect of the server disruption and the new certification checks will need to be assessed over time.
Owners can check whether a box is Play Protect certified, but certification alone should not be treated as proof that a device is safe: Google said some infected boxes had been certified. The source report advises treating suspicious, no-name, or “unlocked” boxes as untrusted, unplugging or replacing them, and keeping TV boxes on a separate guest network where possible. Uninstalling an app may not remove firmware malware that reinstalls after a reboot.
Businesses should account for connected devices on home and office networks as potential security risks, rather than relying only on an IP address’s reputation. The available material does not identify a universal software fix for affected boxes. Until manufacturers, Google, or other authorities provide model-specific guidance, owners should avoid using a suspicious box for sensitive accounts or network access.
Key Questions
What did Google do to the XCPE botnet?
Google and partners disrupted the domains and servers used to control XCPE in late October 2026. Google also said it took legal action against control servers for more than a dozen malware families found as add-ons on the boxes.
How many TV boxes were affected?
Google described XCPE as involving more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to Oct. 1, 2026, and called its count a lower bound. These figures have different scopes and periods.
Does the takedown remove malware from an infected box?
Not necessarily. The source report says the backdoor remains in the firmware and may reinstall itself after a reboot, so deleting an app may not remove it. The server disruption cuts off control infrastructure; the supplied material does not describe a universal cleanup for devices already sold.
How can owners check whether their TV box is affected?
The source report advises checking Play Protect certification and being wary of no-name or “unlocked” boxes. Certification is not a guarantee, because Google said some infected devices were certified. It recommends unplugging or replacing a suspicious box and placing TV devices on a separate guest network.
What is known about Videostrong’s role?
Google said it had high confidence that Shenzhen-based Videostrong built and operated the backdoor for financial gain. The source report says the company did not respond to requests for comment from The Record and heise; the supplied material does not include public court filings or a company response.
Source: ThorstenMeyerAI.com
