🔍 Read the full analysis: Google Disrupts Botnet Linked To Malware On 1.3 Million TV Boxes on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Google and industry partners disrupted the XCPE botnet in late October, after identifying more than 1.3 million set-top boxes linked to it. Google attributes the operation to manufacturer Videostrong, but the backdoor remains in infected devices and can reinstall after a reboot.
Google and industry partners disrupted the control infrastructure of the XCPE botnet in late October, a network linked to more than 1.3 million Android set-top boxes. Google’s Threat Intelligence Group (GTIG) says the botnet’s backdoor was built into device firmware by manufacturer Videostrong Technology Co.; the action cuts off remote control, but does not remove the backdoor from affected boxes.
Google announced the operation in a report published November 2, saying it worked with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI. The steps included legal action to disrupt domains and servers used to control XCPE and distribute malware, as well as control servers associated with more than a dozen malware families installed as add-ons. Google also barred Videostrong and its future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and said it tightened firmware-integrity checks for certified Android TV devices.
The scale figure has more than one source and should be read with its measurement details. Google described the botnet as involving more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and characterized that figure as a lower bound. Google said disruption of the add-on malware’s control servers could also cut access to at least 10 million additional compromised devices. That is an estimate, not a confirmed count of devices affected by XCPE, and reporting cited in the source material says those devices do not all run Android.
According to GTIG, infected boxes were used mainly as residential proxies, routing third-party internet traffic through owners’ home connections, and for advertising fraud. Google also reported capabilities to capture live screenshots, inject keystrokes, collect account and device information, open remote shells and scan local networks. The source material says some affected boxes were Google-certified; Google attributed their passage through review to code that was loaded after the devices’ first boot.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
The Risk Persists After the Takedown
The disruption targets the operators’ ability to communicate with infected devices; it is not a remote cleanup of the devices themselves. GTIG says the backdoor is part of the firmware and can restore itself from a protected partition after a reboot. Removing the visible app therefore may not remove the underlying access. Owners who have one of the affected boxes may still have an untrusted device on their network, even if the botnet’s control servers have been taken down.
The case also raises a supply-chain issue: a device can appear to be an ordinary streaming product while carrying software installed before it reaches a buyer. Google’s account that some infected units were certified suggests that certification checks did not catch every delayed or concealed installation method. For businesses, compromised residential and office devices can also make IP-address reputation less reliable: malicious traffic may appear to come from an ordinary household or workplace connection.
Products Worth Considering
Amazon Kindle Paperwhite (2024), 16 GB, 7-inch Display, Black
Amazon Kindle Paperwhite Signature Edition, 32GB (2024), Metallic Black
Amazon Kindle Scribe (64GB) with Premium Pen, Metallic Jade
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
GTIG describes the backdoor as a small system app, identified in some versions as x.cpe or com.oemservice, with elevated privileges in the device firmware. The report says it contacted a control server when the box started and maintained a connection that allowed operators to send commands and install additional software. Google says the malware disabled Google Play Protect checks before installing other apps.
Google says the operation had several components: a persistent backdoor, a loader and separate modules used to generate revenue. The modules came from affiliates, according to the report. GTIG says the botnet’s design had at least three layers from late 2024; in August 2026, new droppers disguised as Android system apps began replacing the loader. The report presents that change as an effort to remain concealed.
Google’s claim that Videostrong developed and operated the backdoor for financial gain is an attribution by the company, not an independently adjudicated finding in the material provided. The source material says Videostrong did not respond to requests for comment from The Record and heise. It also says Google did not publish the court filing, and no public case record was identified there.
““The backdoor and the botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Disruption Did Not Remove
The available information does not identify every affected model, brand or owner, or provide a complete public list of compromised devices. Google says the control infrastructure was disrupted, but the source material does not establish how many boxes remain infected or whether all operators’ access has ended. It also does not describe a firmware update or other remote process that removes the persistent backdoor.
Google’s allegations about Videostrong have not been accompanied in the source material by a published court filing or case number. Videostrong’s response is not available; the source material reports that the company did not answer requests for comment. The estimated impact on at least 10 million additional compromised devices is also not a measured total, and its device types and overlap with other affected groups are not fully specified.
Device Checks and Further Reporting
Google says it has changed its firmware review process and barred Videostrong from supplying certified Android device makers. The source material does not give a timetable for further enforcement actions, disclose the court records behind the legal steps, or say whether device makers will offer remediation for affected boxes.
For owners, the reported guidance is to check whether a box is Play Protect certified, be cautious with no-name or “unlocked” devices, and treat a suspected affected box as untrusted: disconnect or replace it rather than relying on an app uninstall. Keeping streaming devices on a separate guest network can limit their access to other devices. Businesses should account for connected devices on home and office networks and avoid treating an IP address’s reputation as proof that traffic is benign. More detail on affected models, device-level remediation and the scope of the disrupted infrastructure remains to be established.
Key Questions
What did Google disrupt?
Google and partners took legal and technical steps to disrupt the XCPE botnet’s control infrastructure and servers associated with additional malware. Google says the network involved more than 1.3 million set-top boxes.
Does the takedown remove malware from an infected TV box?
No device cleanup is described in the source material. Google says the backdoor remains in firmware and can reinstall itself after a reboot, so removing an app may not eliminate it.
How did the TV boxes make money for the operators?
Google says they were used mainly as residential proxies, routing other people’s traffic through the device owner’s internet connection, and for advertising fraud. The company also reported more invasive remote capabilities.
Who does Google say was responsible?
Google’s Threat Intelligence Group attributes the backdoor and botnet to Videostrong Technology Co. The source material says Videostrong did not respond to requests for comment and notes that no public court filing was identified.
What should owners do if they suspect their box is affected?
Check the device’s Play Protect certification and treat a suspicious box as untrusted. The guidance in the source material is to unplug or replace it and keep TV boxes on a separate guest network; it does not describe an app uninstall as a fix.
Source: ThorstenMeyerAI.com
